=== TrackSure Cloud – Server-Side Tracking, Meta CAPI & GA4 for WooCommerce ===
Contributors: tracksure, rubait
Tags: server side tracking, meta capi, conversion tracking, woocommerce tracking, analytics
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Server-side conversion tracking & analytics for WordPress and WooCommerce. Meta CAPI, GA4, event deduplication. Free forever.

== Description ==

[youtube https://www.youtube.com/watch?v=5Aw3XLmhZX8]

= ★ What Makes TrackSure Different =

TrackSure is the only free WordPress plugin that combines **server-side conversion tracking** (Meta CAPI + GA4 Measurement Protocol) with a **complete first-party analytics platform** — no GTM required, no external cloud, no monthly fees. Unlike PixelYourSite, TrackSure includes a full analytics dashboard — user journeys, funnels, and attribution — at no extra cost. Unlike GTM-based solutions, it needs no server container, no custom subdomain, and no external hosting.

**42% of internet users run ad blockers, and iOS 14+ reduced Meta Pixel reported conversions by 30–40% for most advertisers.** TrackSure's server-side tracking recovers conversions from both, sending events directly from your WordPress server to Meta, GA4, TikTok, Pinterest, and Google Ads — bypassing browser limitations entirely. Setup takes under 3 minutes: paste your Meta Pixel ID and Access Token, and TrackSure handles the browser pixel, Conversion API, event deduplication, and Advanced Matching for maximum Event Match Quality (EMQ).

= For WooCommerce Store Owners =

If you run WooCommerce and Meta or Google Ads, TrackSure connects your real purchase data directly to your ad platform — bypassing iOS restrictions, ad blockers, and Safari cookie limits. Higher Event Match Quality (EMQ) means better optimization and lower cost-per-acquisition.

= For Marketers & Agencies =

Get user journey tracking, funnel visualization, multi-touch attribution, and traffic source analysis without paying $500/month for Amplitude or Mixpanel. Five attribution models and an assisted conversions report show exactly which channels drive revenue. Manage multiple client sites from the same plugin.

= For Developers =

TrackSure exposes a **JavaScript API** (`window.TrackSure.track()`), a **PHP API**, and **WordPress hooks** (`tracksure_filter_event_data`, `tracksure_conversion_recorded`) for custom event tracking with full server-side control — no dependency on browser JavaScript.

`window.TrackSure.track('button_click', { button_name: 'Download PDF' });`

[Documentation](https://tracksure.cloud/docs) | [Support](https://wordpress.org/support/plugin/tracksure) | [GitHub](https://github.com/tracksure-cloud/tracksure) | [Get Pro](https://tracksure.cloud/pricing)

= What TrackSure Does =

**Server-Side Conversion Tracking (CAPI)**

- Meta Conversion API — send purchase, view content, add to cart, checkout, and page view events server-to-server
- Google Analytics 4 Measurement Protocol — server-side GA4 event forwarding
- TikTok Events API and Pinterest Conversion API (Pro)
- Automatic browser + server event deduplication — each event gets a unique ID shared between client and server so platforms count it once

**First-Party Analytics Dashboard**

- All analytics data stored in your WordPress database — you own every byte
- Automatic traffic source detection — organic search (Google, Bing, DuckDuckGo), social media (Facebook, Instagram, LinkedIn, TikTok), email, referrals, AI chatbots (ChatGPT, Claude, Perplexity), and direct — identified without UTM tags
- Session-based user journeys with 30-day attribution window (configurable) — complete path from first visit to conversion, including every touchpoint across multiple sessions
- Five attribution models: first-touch, last-touch, linear, time-decay, position-based
- Assisted conversion reporting — see which channels helped even without getting final credit
- Real-time visitors — see who is on your site now and what pages they're viewing

**Goals, Funnels & Conversion Tracking**

- Custom conversion goals for form submissions, purchases, downloads, video views, or any event
- Funnel visualization — see where visitors drop off in your checkout or signup flow
- Goal completion rates with trend analysis
- Revenue attribution — connect each sale to its traffic source, campaign, and touchpoint

**eCommerce Conversion Tracking**

- Auto-tracks the full purchase funnel: product view → add to cart → checkout → purchase
- Works with WooCommerce and FluentCart (Free), Easy Digital Downloads, SureCart, Cartflow, and MemberPress (Pro)
- Revenue attribution — connect each sale to its traffic source and campaign
- Checkout funnel visualization with drop-off rates at each step

**Privacy & Compliance**

- GDPR and CCPA ready with built-in consent manager support (Cookiebot, CookieYes, OneTrust, and more)
- Cookieless tracking option (uses localStorage instead of cookies — no consent banner required in some jurisdictions)
- IP anonymization, Do Not Track (DNT) support, and WordPress privacy tools integration
- No data leaves your server unless you explicitly enable an ad platform destination

= Who Is TrackSure For? =

- **WooCommerce & FluentCart store owners** running paid ads who need more accurate conversion data for Meta, Google Ads, and other platforms
- **Bloggers & content creators** who want to see which posts bring the most traffic, engagement, and conversions
- **Small business owners** who need simple, privacy-friendly analytics without Google Analytics complexity
- **Digital marketers** managing ad campaigns who want user journey tracking, funnel visualization, and multi-touch attribution
- **Agencies & freelancers** who need analytics and conversion tracking across client sites (Pro includes white label)
- **Privacy-focused site owners** who want GDPR-compliant analytics without sending data to external services
- **Developers** who need JavaScript and PHP APIs for custom event tracking with WordPress hooks

= Free vs Pro =

**Free** includes everything you need for analytics and conversion tracking:

- First-party analytics dashboard with user journeys, funnels, goals, and attribution
- Real-time visitor tracking
- Meta Pixel + Conversion API (CAPI) server-side tracking
- Google Analytics 4 + Measurement Protocol server-side tracking
- WooCommerce and FluentCart automatic ecommerce tracking
- All form plugins (Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Elementor Forms)
- All page builders (Elementor, Divi, Beaver Builder, Gutenberg, WPBakery, Oxygen, Bricks)
- Five attribution models with assisted conversion reports
- Consent management integration
- Unlimited events and sessions

**Pro** adds advanced ad platforms and ecommerce integrations:

- 14+ ad platform destinations: TikTok, Pinterest, LinkedIn, Snapchat, Reddit, Google Ads, Microsoft Ads, Twitter/X, Taboola, Outbrain, and more
- Advanced ecommerce: Easy Digital Downloads, SureCart, Cartflow, MemberPress, LearnDash, Amelia, WooCommerce Bookings, GiveWP
- Cart abandonment emails, session recording, heatmaps, cohort analysis, predictive analytics
- Email marketing sync (Mailchimp, ActiveCampaign, Klaviyo)
- White label for agencies
- Priority support with 24-hour response time

[Compare Plans](https://tracksure.cloud/pricing)

= Integrations =

- **eCommerce:** WooCommerce, FluentCart, Easy Digital Downloads (Pro), SureCart (Pro), Cartflow (Pro), MemberPress (Pro)
- **Forms:** Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Elementor Forms
- **Builders:** Elementor, Divi, Beaver Builder, Gutenberg, WPBakery, Oxygen, Bricks
- **Ad Platforms:** Meta (Facebook/Instagram), Google Analytics 4, Google Ads (Pro), TikTok (Pro), Pinterest (Pro), LinkedIn (Pro), Snapchat (Pro), Microsoft Ads (Pro), Reddit (Pro), Twitter/X (Pro), Taboola (Pro), Outbrain (Pro)
- **Consent:** Cookiebot, CookieYes, OneTrust, and custom consent filters

= Getting Started =

1. Install and activate TrackSure Cloud from the WordPress plugin directory
2. Visit **TrackSure → Settings** to review tracking and privacy options
3. (Optional) Add your Meta Pixel ID + Access Token or GA4 Measurement ID for server-side conversion tracking
4. Go to **TrackSure → Overview** — analytics data starts appearing after 1 hour

== External services ==

This plugin connects to external third-party services to provide its functionality. Below is a complete list of all external services used, when they are called, what data is transmitted, and links to their terms of service and privacy policies.

**When You Enable Meta Pixel / Conversion API:**

- **Service:** Meta (Facebook) Graph API
- **Purpose:** Send conversion events (purchases, add-to-cart, page views) to Facebook for ad optimization
- **What data is sent:** Event name, timestamp, hashed user email/phone (if available), product SKU, revenue, IP address, user agent, pixel ID
- **When it's sent:** Automatically when a tracked event occurs (product view, purchase, etc.) and Meta destination is enabled in settings
- **Service provider:** Meta Platforms, Inc.
- **Terms of Service:** https://www.facebook.com/legal/terms
- **Privacy Policy:** https://www.facebook.com/privacy/policy
- **Data Processing Agreement:** https://www.facebook.com/legal/terms/dataprocessing

**When You Enable Google Analytics 4:**

- **Service:** Google Analytics 4 Measurement Protocol
- **Purpose:** Send analytics events to Google Analytics for website traffic analysis
- **What data is sent:** Event name, page URL, referrer, session ID, client ID, IP address, user agent, device information
- **When it's sent:** Automatically when page views or custom events occur and GA4 destination is enabled in settings
- **Service provider:** Google LLC
- **Terms of Service:** https://marketingplatform.google.com/about/analytics/terms/us/
- **Privacy Policy:** https://policies.google.com/privacy

**When Loading Google Tag Manager Script (If Enabled):**

- **Service:** Google Tag Manager CDN
- **Purpose:** Load gtag.js library for browser-side Google Analytics tracking
- **What data is sent:** Standard HTTP request data (IP address, user agent, referrer) when loading the script
- **When it's sent:** On every page load when GA4 browser tracking is enabled
- **Service provider:** Google LLC
- **Script URL:** https://www.googletagmanager.com/gtag/js
- **Terms of Service:** https://marketingplatform.google.com/about/analytics/terms/us/
- **Privacy Policy:** https://policies.google.com/privacy

**When Loading Facebook Pixel Script (If Enabled):**

- **Service:** Facebook Connect CDN
- **Purpose:** Load fbevents.js library for browser-side Facebook Pixel tracking
- **What data is sent:** Standard HTTP request data (IP address, user agent, referrer) when loading the script
- **When it's sent:** On every page load when Meta Pixel browser tracking is enabled
- **Service provider:** Meta Platforms, Inc.
- **Script URL:** https://connect.facebook.net/en_US/fbevents.js
- **Terms of Service:** https://www.facebook.com/legal/terms
- **Privacy Policy:** https://www.facebook.com/privacy/policy

**Cloudflare IP Detection (Always Active):**

- **Service:** Cloudflare IP Ranges API
- **Purpose:** Fetch current list of Cloudflare proxy IP addresses to accurately detect real visitor IPs behind Cloudflare CDN. A bundled static list is included as fallback.
- **What data is sent:** Standard HTTP request headers only (no user data transmitted)
- **When it's sent:** Once per day (cached for 24 hours) to refresh the Cloudflare IP list. The plugin includes a bundled fallback list and works without this request.
- **Service provider:** Cloudflare, Inc.
- **API URLs:** https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6
- **Terms of Service:** https://www.cloudflare.com/website-terms/
- **Privacy Policy:** https://www.cloudflare.com/privacypolicy/

**IP Geolocation (When Tracking Is Enabled):**

- **Service:** ipapi.co (primary), ip-api.com (secondary fallback), WordPress.com Geo API (tertiary fallback)
- **Purpose:** Determine the country, region, and city of visitors based on their IP address for geographic analytics reporting
- **What data is sent:** The visitor's IP address is sent to one of the geolocation providers. No other user data is transmitted.
- **When it's sent:** When a new visitor session is recorded and the IP has not been looked up recently. Results are cached for 24 hours per IP.
- **Service providers and policies:**
  - **ipapi.co** (primary) – https://ipapi.co/privacy/ and https://ipapi.co/terms/
  - **ip-api.com** (fallback) – https://ip-api.com/docs/legal
  - **WordPress.com Geo API** (fallback) – https://automattic.com/privacy/ and https://wordpress.com/tos/

**Important Notes:**

- **No automatic data sharing:** TrackSure does NOT send any data to third-party services unless you explicitly enable and configure them in TrackSure Settings → Destinations.
- **Consent-aware:** If you use a cookie consent plugin (Cookiebot, CookieYes, etc.), TrackSure will respect user consent choices and only fire pixels after consent is granted.
- **First-party analytics:** TrackSure's core analytics features store all data in your WordPress database. No external services are used for analytics unless you enable Google Analytics 4 or other destinations.
- **You control the data:** You choose which platforms to enable, what events to track, and what user data to include (emails, phones, etc.).

For more information about data privacy and compliance, see the **Privacy & GDPR Compliance** section below.

== Source Code & Build Instructions ==

The admin interface is built with React 18 and TypeScript, compiled with Webpack 5. The compiled files in `admin/dist/` are generated from the source code in `admin/src/`.

**Full source code is available on GitHub:**
[https://github.com/tracksure-cloud/tracksure](https://github.com/tracksure-cloud/tracksure)

**To build from source:**

1. Navigate to the `admin/` directory
2. Run `npm install` to install dependencies
3. Run `npm run build` for a production build, or `npm run dev` for development mode with watch

**Build tools used:**

- Node.js (v18+)
- npm
- Webpack 5 (config: `admin/webpack.config.js`)
- TypeScript 5 (config: `admin/tsconfig.json`)
- ts-loader for TypeScript compilation

**Key source directories:**

- `admin/src/` — React/TypeScript source code (pages, components, contexts, hooks)
- `admin/dist/` — Compiled production JavaScript (generated by Webpack)
- `assets/js/` — Frontend tracking scripts (non-compiled, human-readable)
- `includes/` — PHP backend (non-compiled, human-readable)

== Installation ==

= From WordPress Admin =

1. Go to **Plugins → Add New**
2. Search for **"TrackSure"**
3. Click **Install Now**, then **Activate**

= Manual Upload =

1. Download the ZIP from WordPress.org
2. Go to **Plugins → Add New → Upload Plugin**
3. Upload the ZIP, install, and activate

= After Activation =

1. Go to **TrackSure → Settings**
2. Tracking is enabled by default — data appears in your dashboard immediately
3. (Optional) Add Meta Pixel ID + Access Token or GA4 Measurement ID under **Destinations** for server-side ad tracking
4. If WooCommerce or FluentCart is active, eCommerce events are tracked automatically (EDD, SureCart, Cartflow, MemberPress available in Pro)

== Frequently Asked Questions ==

= How does TrackSure improve ROAS and lower CPA? =

When browser-side pixels miss conversions (due to iOS 14+, ad blockers, or cookie restrictions), ad platforms optimize on incomplete data and your cost-per-acquisition rises. TrackSure fixes this by sending conversion events **server-to-server** via Meta Conversion API and GA4 Measurement Protocol. Browser and server events are deduplicated automatically, so platforms see more of your real conversions without double-counting. More complete data means better optimization and improved Return on Ad Spend.

= How do I set up the Meta Pixel with server-side tracking? =

Meta Pixel setup in TrackSure takes under 5 minutes:

1. Install and activate TrackSure Cloud
2. Go to **TrackSure → Settings → Destinations → Meta**
3. Enter your **Pixel ID** (from Meta Events Manager)
4. Generate and paste a **Conversion API Access Token** (Events Manager → Pixel → Settings → Conversions API)
5. Enable "Server-Side Tracking (CAPI)" and save

TrackSure automatically fires both the browser Meta Pixel and Meta Conversion API (CAPI) events server-to-server. Browser and server events are deduplicated using a shared event_id, so Meta counts each conversion once. User data (email, phone, name, address) is hashed and sent as Advanced Matching parameters for maximum Event Match Quality (EMQ). No Google Tag Manager server container required.

= What is server-side tracking and why do I need it? =

Server-side tracking sends conversion events directly from your WordPress server to ad platforms like Meta, Google Analytics, TikTok, and Pinterest — instead of relying only on browser JavaScript pixels. This matters because:

- **Ad blockers** block ~40% of browser tracking pixels
- **iOS 14+ App Tracking Transparency** reduced Meta Pixel reported conversions by 30–40%
- **Safari ITP** limits first-party cookies to 7 days, causing session data loss
- **Browser privacy features** increasingly restrict third-party tracking

With server-side tracking, your conversion data bypasses all browser restrictions. Ad platforms see your real sales, optimize better, and your ROAS improves. TrackSure sends server-side events directly from WordPress — no GTM server container, no external cloud, no third-party services.

= Do I need to run ads to use TrackSure? =

No. TrackSure is a **standalone first-party analytics platform** that works without any ad platform. You get traffic source tracking, user journeys, content performance, goal tracking, funnel visualization, revenue attribution, and real-time monitoring — all stored in your WordPress database. The ad platform integrations (Meta, Google, TikTok) are optional.

= What is Meta Conversion API (CAPI)? =

Meta CAPI (Conversion API) sends conversion events directly from your server to Meta, bypassing browser restrictions. TrackSure handles both the browser Meta Pixel and server-side CAPI automatically. Events are deduplicated using a shared event_id so conversions are never double-counted. See the "How do I set up the Meta Pixel with server-side tracking?" FAQ above for setup steps.

= Does TrackSure support Google Analytics 4 (GA4)? =

Yes. TrackSure supports GA4 with both browser-side tracking (gtag.js) and server-side event forwarding via the GA4 Measurement Protocol. This dual approach ensures your GA4 data is accurate even when browsers block tracking scripts.

= Does TrackSure detect traffic sources without UTM parameters? =

Yes. TrackSure automatically identifies organic search (Google, Bing, DuckDuckGo etc.), social media (Facebook, Instagram, LinkedIn, TikTok), email clients (Gmail, Outlook), AI chatbots (ChatGPT, Claude, Perplexity), referral sites, and direct traffic. UTM parameters are also captured when present.

= What eCommerce platforms does TrackSure support? =

TrackSure auto-tracks the full purchase funnel (product view → add to cart → checkout → purchase) for **WooCommerce** and **FluentCart** in the free version. No manual event setup required. Pro adds Easy Digital Downloads, SureCart, Cartflow, MemberPress, LearnDash, Amelia, WooCommerce Bookings, GiveWP, and more.

= Does TrackSure work with WooCommerce? =

Yes. TrackSure automatically tracks all WooCommerce ecommerce events: product view, add to cart, remove from cart, initiate checkout, and purchase — including order value, SKU, and product categories. Server-side tracking via Meta CAPI and GA4 Measurement Protocol ensures conversions are captured even when browser tracking is blocked.

= How do user journeys and funnel tracking work? =

TrackSure records every page a visitor views across sessions. Go to **TrackSure → Visitor Journeys** to see the complete path from first visit to conversion, including all touchpoints, time between visits, and how many sessions it took to convert. The funnel view shows drop-off rates at each step of your checkout or signup flow.

= What attribution models are available? =

Five models are included: **First-Touch** (credits the channel that first brought the visitor), **Last-Touch** (credits the final interaction before conversion), **Linear** (equal credit to all touchpoints), **Time-Decay** (more credit to recent interactions), and **Position-Based** (40% first, 40% last, 20% middle). The attribution window defaults to 30 days and is configurable. Assisted conversion reports show which channels helped without getting final credit.

= Does TrackSure support Google Consent Mode v2? =

Yes. TrackSure integrates with consent management platforms including Cookiebot, CookieYes, and OneTrust. It respects user consent choices and only fires tracking pixels after consent is granted. Cookieless tracking mode is also available for sites that want to track without cookies or consent banners.

= Is TrackSure GDPR and CCPA compliant? =

Yes. TrackSure includes cookieless tracking (localStorage), IP anonymization, Do Not Track (DNT) support, and integrates with consent managers. Users can request data export and deletion through WordPress privacy tools. No data leaves your server unless you enable an ad platform.

= Will TrackSure slow down my website? =

No. The tracking script loads asynchronously (non-blocking), events are batched to reduce HTTP requests, database queries use indexed tables, and dashboard metrics are pre-computed. Compatible with WP Rocket, LiteSpeed, W3 Total Cache, Cloudflare, and other caching/CDN solutions.

= Does TrackSure work with High-Performance Order Storage (HPOS)? =

Yes. TrackSure is fully compatible with WooCommerce HPOS (High-Performance Order Storage) and uses its own database tables for analytics, so it doesn't affect your store's order processing performance.

= Do I need a GTM server container? =

No. TrackSure sends server-side events directly from your WordPress server to ad platform APIs. No Google Tag Manager server container, no external cloud hosting, and no custom subdomain setup required.

= Can I track custom events and goals? =

Yes. TrackSure provides a **JavaScript API** and a **PHP API** for custom events, plus a goal system for tracking form submissions, downloads, video views, purchases, or any custom action.

**JavaScript:** `window.TrackSure.track('button_click', { button_name: 'Download PDF' });`

**WordPress hooks for developers:**
- `tracksure_filter_event_data` — modify any event before storage
- `tracksure_session_started` — run custom logic on new sessions
- `tracksure_conversion_recorded` — sync conversions to CRM, email, or external systems

= What's the difference between Free and Pro? =

**Free** includes: first-party analytics, user journeys, funnel tracking, goals, real-time tracking, Meta Pixel + CAPI, GA4 + Measurement Protocol, WooCommerce and FluentCart auto-tracking, all form plugins, all page builders, all 5 attribution models, assisted conversions, consent management, and unlimited events.

**Pro** adds: 14+ ad platforms (TikTok, Pinterest, LinkedIn, Snapchat, Reddit, Google Ads, Microsoft Ads, and more), advanced ecommerce integrations (Easy Digital Downloads, SureCart, Cartflow, MemberPress), cart abandonment emails, session recording, heatmaps, cohort analysis, predictive analytics, email marketing sync, white label for agencies, and priority support.

[Compare Plans](https://tracksure.cloud/pricing)

= Where is my data stored? =

All tracking data is stored in your WordPress database — not on TrackSure servers or any third party. Raw events are retained for 90 days (configurable: 30/60/90/180 days), and aggregated metrics (no PII) are kept indefinitely. Automatic daily cleanup removes expired data via WP-Cron.

= Can I export analytics data? =

Yes. Every report page has a **CSV export** button. All data is also accessible directly in your WordPress database (`wp_tracksure_events`, `wp_tracksure_sessions`, `wp_tracksure_analytics_daily`). Pro adds REST API endpoints for programmatic access.

= Does TrackSure work with page builders? =

Yes — Elementor, Divi, Beaver Builder, Gutenberg, WPBakery, Oxygen, and Bricks are all supported. Page views, button clicks, form submissions, and popup interactions are tracked automatically.

= Can I use TrackSure on client sites / white label? =

The free version can be installed on unlimited sites. Pro includes a white label option — rebrand the plugin name, logo, menu, and support URL for your agency.

== Screenshots ==

1. Overview Dashboard - KPIs, traffic trends, top sources
2. Real-Time Dashboard - Active users and live sessions
3. Traffic Sources - Source/medium breakdown with conversions
4. Top Pages - Most visited pages with engagement metrics
5. Goals & Conversions - Custom goals and funnel visualization
6. Settings - Configure tracking, destinations, and privacy

== Changelog ==

= 1.2.7 - 2026-07-12 =
* Fix: GA4 Measurement Protocol events now reuse the visitor's real GA4 client_id and session_id (captured from the first-party _ga / _ga_{stream} cookies) instead of a separate TrackSure identity — resolves "(not set)" / Unassigned traffic and doubled sessions in GA4 acquisition reports
* Fix: GA4 server-side delivery now checks browser pixel confirmation before sending — resolves duplicate purchase/ecommerce events appearing twice in GA4 (once with correct source/medium, once as "(not set)")
* Fix: FluentCart purchase events (order_paid_done) are no longer silently dropped when processed asynchronously via Action Scheduler — affected all payment gateways including Razorpay
* Fix: FluentCart cart and checkout events (view_cart, begin_checkout) now use the store's actual currency instead of defaulting to USD — affects all non-USD stores
* Fix: Settings now save correctly on sites running LiteSpeed Cache — REST API responses are marked no-cache and page caches are purged automatically after a settings change
* Fix: Reddit tracking — rdt_cid (Reddit click ID) is now captured from ad landing URLs, persisted to sessions, and forwarded to the Reddit Conversions API for proper attribution and deduplication
* Improvement: Automatic database migration (DB v1.0.2) adds rdt_cid column to tracksure_sessions table on existing installs — no manual action required
* Fix (Pro): Reddit Pixel now correctly sends value, currency, transactionId, itemCount, products, and search at the top level of the pixel options object — these params were previously silently dropped inside customEventProperties
* Fix (Pro): Reddit Conversions API server-side events now correctly detect HTTP 200 success responses — previously all API calls were incorrectly reported as failures even when Reddit accepted them
* Fix (Pro): begin_checkout event now maps to Reddit's InitiateCheckout standard event instead of AddToCart
* Fix (Pro): Removed incorrect uuid field from Reddit CAPI user data — uuid must come from the Reddit Pixel browser cookie, not the server-side event ID

= 1.2.6 - 2026-05-22 =
* Fix: Meta Pixel initialized with `{autoConfig: false}` to prevent Meta's automatic checkout/purchase event detection from firing a duplicate, parameterless `InitiateCheckout` alongside TrackSure's enriched server-side event

= 1.2.5 - 2026-04-28 =
* Fix: PHP E_WARNINGs on attribution rows — null coalescing added for first/last touch conversion and revenue fields in query controller
* Fix: DB SQL error "Unknown column dest.destination" in delivery stats — corrected JSON_TABLE alias and join condition in diagnostics controller
* Fix: FluentCart offline/COD purchase tracking — orders with `pending` payment status (offline_payment method) are now correctly tracked; status list is filterable via `tracksure_fluentcart_purchase_statuses`
* Fix: GA4 Measurement Protocol session attribution — changed `source`/`medium`/`campaign` to required `session_source`/`session_medium`/`session_campaign` params so active users show traffic source in GA4
* Fix: Pro settings schema now always registered before license gate so REST API accepts `tracksure_forminator_enabled` and `tracksure_bit_form_enabled` keys without validation errors

= 1.2.4 - 2026-04-27 =
* Improvement: Redesigned admin sidebar navigation — split 11-item Analytics group into 5 focused groups (Analytics, Behaviour, Conversions, Tools, Settings) for better UX
* Improvement: Data Quality moved to Tools group alongside Diagnostics for logical grouping
* Improvement: Conversions group now follows logical setup-to-report order: Goals → Conversions → Attribution
* Improvement: Admin panel default theme set to light mode
* Fix: Dark theme card backgrounds now use opaque tokens (--ts-card-bg) instead of semi-transparent --ts-surface — eliminates white bleed-through in dark mode
* Fix: SVG sparkline gradient IDs sanitized (spaces removed) — resolves invalid SVG spec warning
* Improvement: Sparkline fill color is now neutral indigo (non-alarming) while stroke color reflects trend direction

= 1.2.3 - 2026-04-19 =
* Fix: Meta CAPI "Invalid parameter" error — removed unsupported `address`/`ad` field from user_data, added strict whitelist of Meta-accepted fields
* Fix: Browser/server race condition — concurrent add_to_cart requests with same event_id caused server's ecommerce_data to be silently dropped (INSERT IGNORE → ON DUPLICATE KEY UPDATE)
* Fix: Outbox payload merge — when browser event wins the outbox INSERT race, server's richer payload (items[], value, currency) is now merged back
* Fix: add_to_cart double-counting — browser and server now use item_id as content identifier for deterministic event_id, preventing duplicate events
* Fix: Grouped product add_to_cart — browser no longer fires a hollow add_to_cart for grouped product parent; server correctly fires individual events per child item with full ecommerce data
* Fix: Pipeline diagnostics Section 6 now correctly shows "Skipped" instead of "Pending" for events without destination mapping
* Fix: Pipeline diagnostics Section 10 now correctly shows "Skipped" instead of "Pending" for non-Meta events
* Improvement: Enhanced Meta CAPI error capture with error code and subcode for faster debugging

= 1.2.2 - 2026-04-13 =
* Fix: WooCommerce purchase event now uses transactional event_id (order_id based) for reliable Meta CAPI deduplication — consistent with FluentCart
* Fix: Checkout form billing data (email, phone, name, address) was not being saved — replaced dead filter with woocommerce_checkout_order_processed hook
* Fix: Guest user billing fields now enrich EMQ (Event Match Quality) data on the thank-you page for Meta CAPI and server-side destinations
* Fix: Checkout form JS event_id generation corrected from 'purchase' to 'begin_checkout' — purchase event_id is now transactional

= 1.2.1 - 2026-04-06 =
* Fix: Resolved 9,234+ PHPCS coding standards violations across 22 files via auto-formatter
* Fix: Fixed 3 PreparedSQL placeholder errors in dynamic database INSERT queries
* Fix: Fixed undefined $event variable bug in event builder — page context data (title, URL, referrer) was not being passed to validated params
* Fix: Added strict comparison (true) to all in_array() calls for type safety
* Fix: Changed urlencode() to rawurlencode() for RFC 3986 compliant URL encoding in geolocation
* Fix: Converted loose == comparisons to strict === with proper type casting
* Improvement: Updated PHPCS ruleset to suppress VIP-specific false positives for non-VIP hosting
* Improvement: Suppressed noisy warnings (commented-out code detection, unused hook params, global redeclarations)

= 1.2.0 - 2026-04-04 =
* Improvement: Meta EMQ (Event Match Quality) now sends full user data (em, fn, ln, ph, ct, st, zp, country) with purchase events for both WooCommerce and FluentCart
* Improvement: FluentCart purchase events now pull billing address data (name, phone, city, zip) from order addresses instead of sparse customer profile
* Improvement: Meta pixel sender re-initializes fbq with per-event user_data before firing for accurate Advanced Matching
* Fix: FluentCart EMQ was only sending country, state, and external_id — now sends all available checkout fields

= 1.1.0 - 2026-04-01 =
* New: Milestone celebrations — celebrate visitor milestones (1/50/100/500/1K/5K/10K) and conversion milestones (1/10/50/100/500) with confetti burst animations
* New: Tier-based celebration themes — starter, growing, popular, champion, and legendary tiers with unique colors and icons
* Improvement: Loading spinner no longer conflicts with other plugin spinner styles
* Fix: Light theme button text now uses solid white color for consistent readability
* Fix: Dark mode milestone toast backgrounds are now opaque for better text readability

= 1.0.5 - 2026-04-01 =
* New: SEO-friendly plugin name for better WordPress.org search visibility (server side tracking, meta pixel, CAPI, WooCommerce)
* New: Onboarding welcome banner after first activation — guides users through Live tab, admin tracking, dashboard timing, and CAPI setup
* Improvement: Tracking now enabled by default on fresh installs — users see data immediately without manual configuration
* Improvement: Updated plugin description and tags for better discoverability

= 1.0.4 - 2026-04-01 =
* Fix: MariaDB compatibility — replaced MySQL-only JSON ->> operator with JSON_UNQUOTE(JSON_EXTRACT()) for cross-database support
* Fix: Logger column mismatch — aligned code with installer schema (context_json → context, log_id → id)
* Fix: Race condition duplicate entry errors on visitors, sessions, and outbox tables — replaced SELECT-then-INSERT with INSERT IGNORE
* Fix: Added automatic database upgrade mechanism so schema changes apply on plugin update, not just activation

= 1.0.3 - 2026-03-31 =
* Fix: Re-release of 1.0.2 (previous SVN upload was corrupted)

= 1.0.2 - 2026-03-31 =
* Fix: Journeys page now shows correct total visitor count — previously limited to 50 due to missing server-side pagination
* Fix: Sessions page summary cards (total sessions, conversions, revenue) now display accurate global totals instead of current-page-only counts
* Fix: Filter button labels on Journeys page now show correct counts across all data
* Improvement: Journeys page uses true server-side pagination for better performance with large datasets
* Improvement: Frontend JS files are now minified (132 KB saved) with SCRIPT_DEBUG-aware switching
* Improvement: Inlined event registry via wp_localize_script — eliminates extra HTTP request on every page load

= 1.0.1 - 2026-03-03 =
* Fix: Goal cards now correctly display performance data (conversions, revenue, conversion rate) — batch performance cache was returning data without the expected wrapper key
* Fix: 3 broken goal templates (scroll_depth, time_on_page, video_complete) now fire correctly
* Fix: Goal condition evaluator type coercion — wp_localize_script sends numbers as strings, causing operator comparisons to fail
* Fix: Ecommerce platform detection now recognizes SureCart and FunnelKit
* Improvement: All 6 frontend scripts now use defer loading strategy for better page speed
* Improvement: Conditional script loading — minicart/currency scripts only load when ecommerce is active, goal scripts only when goals exist
* Improvement: Added loading skeleton placeholders on goal cards while performance data loads
* Improvement: PHP goal evaluator uses secondary trigger_type index for faster lookups
* Improvement: Reduced goal cache TTL from 5 minutes to 1 minute for fresher dashboard data
* Improvement: Added auto-refresh (5 min) for performance queries

= 1.0.0 - 2026-02-05 =
- Initial release
- Browser tracking SDK with comprehensive event capture
- Server-side integrations (WooCommerce, FluentCart, EDD, SureCart)
- First-party analytics dashboards
- Multi-touch attribution (first-touch, last-touch, linear, time-decay, position-based)
- Meta Pixel + CAPI integration
- GA4 gtag.js + Measurement Protocol integration
- Privacy-first features (GDPR compliance, cookieless mode)
- Performance optimizations (caching, CDN compatibility)

== Upgrade Notice ==

= 1.2.7 =
Important fixes: GA4 duplicate/"(not set)" traffic resolved, FluentCart async purchases no longer dropped, FluentCart currency defaults fixed, settings now save correctly with LiteSpeed Cache, and Reddit rdt_cid click ID tracking added across the full pipeline. DB migration (v1.0.2) runs automatically — no manual action needed. Recommended for all users.

= 1.2.0 =
Meta EMQ improvement: Purchase events now send full user data (email, name, phone, address) for better ad attribution. Critical fix for FluentCart EMQ.

= 1.1.0 =
New milestone celebrations with confetti animations for visitor and conversion milestones. Loading spinner and button color fixes.

= 1.0.5 =
New onboarding guide, tracking enabled by default, SEO-friendly plugin name for better search visibility.

= 1.0.4 =
Critical fix: Resolves MariaDB compatibility errors, duplicate entry race conditions, and logger schema mismatches.

= 1.0.3 =

= 1.0.2 =
Data accuracy fix: Journeys and Sessions pages now show correct totals. Frontend JS minified for faster page loads.

= 1.0.1 =
Bug fix release: Fixes goal performance data not displaying on cards, broken goal templates, and type coercion issues. Adds deferred script loading for better page speed.

= 1.0.0 =
Initial release of TrackSure - Complete first-party analytics and attribution platform for WordPress.

== Privacy Policy ==

TrackSure stores the following data in your WordPress database:

**Tracking Data (90-day retention):**
- Page URLs visited
- Referrer URLs
- UTM campaign parameters
- Device type (desktop/mobile/tablet)
- Browser and OS information (user agent)
- IP address (can be anonymized)
- Session duration and engagement metrics

**For E-commerce (if using WooCommerce/FluentCart/EDD/SureCart):**
- Product views
- Cart actions
- Order completion (order ID, total, items)
- Customer email and phone (hashed when sent to Meta/GA4)

**External Data Sharing (Optional):**

TrackSure stores all analytics data locally in your WordPress database. No data is sent to external services unless you enable ad platform integrations.

**Privacy Controls:**
- **IP Anonymization:** Available in Settings → Privacy. Default is off for accurate geo reporting; enable it for GDPR compliance.
- **Cookieless Mode:** Uses localStorage instead of cookies to avoid cookie consent requirements.
- **Consent Integration:** Respects Cookiebot, CookieYes, OneTrust, and custom consent filters.

**Supported Third-Party Services:**

TrackSure connects to the following services **only when you enable them** and provide API credentials.

**1. Meta (Facebook/Instagram) - Available in Free & Pro**
-   **Method:** Server-to-Server via Meta Graph API (CAPI)
-   **Data Sent:** Event data (PageView, ViewContent, AddToCart, Checkout, Purchase), Hashed user data (email, phone, IP, User Agent)
-   **Purpose:** Ad optimization and attribution

**2. Google Analytics 4 (GA4) - Available in Free & Pro**
-   **Method:** Server-to-Server via Measurement Protocol
-   **Data Sent:** Event parameters, Client ID, User Agent, IP
-   **Purpose:** Analytics reporting

**3. Pro-Only Integrations (Add-ons)**
-   **Google Ads:** Sends offline conversion adjustments via Google Ads API.
-   **TikTok:** Sends web events via TikTok Events API.
-   **Pinterest:** Sends conversion events via Pinterest API.
-   **Snapchat:** Sends conversion events via Snapchat Conversions API.
-   **Microsoft Ads:** Sends offline conversions via Microsoft Ads API.
-   **LinkedIn:** Sends conversion events via LinkedIn CAPI.

You must obtain user consent before enabling these destinations (GDPR/CCPA requirement).

**Your Responsibilities:**

- Disclose TrackSure's tracking in your privacy policy
- Obtain consent before tracking (if required by law)
- Configure data retention periods appropriately
- Enable IP anonymization if required

**Data Deletion:**

Users can request data deletion via WordPress Privacy Tools or TrackSure Settings → Privacy.

== Support ==

**Free Support:**

- [Documentation](https://tracksure.cloud/docs)
- [Community Forum](https://wordpress.org/support/plugin/tracksure)


**Pro Support:**

- Email support with 24-hour response time
- Priority bug fixes
- Feature requests
- Implementation consulting

[Get Pro Support](https://tracksure.cloud/support)

== Trademarks & Third-Party Services ==

TrackSure integrates with various third-party analytics and advertising platforms. All trademarks, service marks, and company names mentioned in this plugin are the property of their respective owners.

**Third-Party Platforms:**
- Meta, Facebook, Instagram, and Facebook Pixel are trademarks of Meta Platforms, Inc.
- Google, Google Analytics, Google Ads, and GA4 are trademarks of Google LLC.
- TikTok is a trademark of ByteDance Ltd.
- Pinterest is a trademark of Pinterest, Inc.
- Snapchat is a trademark of Snap Inc.
- LinkedIn is a trademark of Microsoft Corporation.
- Twitter (X) is a trademark of X Corp.
- Reddit is a trademark of Reddit Inc.
- Microsoft Ads is a trademark of Microsoft Corporation.

**Integration Requirements:**
- Users must have active accounts with third-party platforms to use their respective features
- API access requires platform-specific credentials and compliance with their terms of service
- Data transmission follows each platform's API specifications and privacy policies
- Users are responsible for compliance with each platform's terms of service

TrackSure is an independent plugin and is not officially affiliated with, endorsed by, or sponsored by any of the companies mentioned above. All product names, logos, brands, and trademarks are property of their respective owners.

**Data Privacy:** TrackSure sends conversion data to enabled platforms only with user consent. No data is transmitted to third parties unless explicitly configured by the site administrator.
