# PixelGuard: Server-Side Meta Conversion Tracking for Shopify > **PixelGuard is the Shopify app that compares the orders your store actually took against how many your checkout tracking actually fired on, shows the gap in money daily for free, and relays purchase events to the Meta Conversions API (CAPI) server-side on the paid plan.** It protects Meta (Facebook/Instagram) conversion tracking through Shopify's Checkout Extensibility migration, works where ad-blockers and iOS block the browser pixel, and monitors tracking health 24/7. Free plan with no card required; Pro is $29.99/month (or $299.99/year) with a 14-day trial. --- ## Problem Statement ### The Checkout Extensibility Migration Crisis Shopify is requiring all stores to migrate to Checkout Extensibility: - **Plus stores deadline:** August 28, 2025 - **All other stores deadline:** August 26, 2026 When this migration completes, Shopify removes `checkout.liquid` and Additional Scripts. Any Meta/Facebook Pixel, Google Ads, TikTok Pixel, or GA4 conversion tracking installed via script tags **silently stops firing** on the checkout and thank-you pages. Merchants receive no warning from Shopify about broken tracking. ### The Ad-Blocker Problem Even before the migration, browser-based conversion pixels are already degraded: - Ad-blockers (uBlock Origin, AdBlock Plus, Brave) prevent pixel fires for 20-40% of visitors - iOS App Tracking Transparency (ATT) limits cross-site tracking - Firefox Enhanced Tracking Protection blocks third-party cookies - Safari Intelligent Tracking Prevention limits cookie lifetimes ### The Business Impact Every missed conversion event means: - Meta's algorithm cannot attribute the sale to the correct ad - Lookalike audiences become less accurate - Automated bidding (CBO, ASC) optimizes on incomplete data - ROAS reporting understates true performance - Ad spend is wasted on campaigns that appear underperforming but may actually be working --- ## How PixelGuard Works ### Architecture Overview ``` Shopify Checkout (checkout_completed event) | v Web Pixel Extension (strict sandbox, no DOM access) | Signed POST with HMAC auth token v PixelGuard Ingestion API (/api/events/ingest) - Validates auth token (constant-time comparison) - Rate limits (200 events/shop/minute via Redis) - Hashes customer PII with SHA-256 (raw values never stored) - Creates ConversionEvent + EventDelivery records, and increments DailyStats capture counters (even for a shop with no destinations) - Enqueues relay job | v Background Relay Worker (BullMQ, concurrency: 10) - Decrypts stored Meta credentials (AES-256-GCM) - Builds Meta Conversions API payload - Includes an event_id used as an idempotency key on PixelGuard's ingest endpoint - Sends to Meta Graph API (v25.0) - Records delivery status (delivered/failed + HTTP code) | v Monitoring System (heartbeat hourly; anomaly + retention every 6 hours; reconciliation daily 02:00 UTC) - Checks each destination for delivery gaps > 24 hours - Sends email alerts via Resend if tracking stops - Weekly digest emails on Mondays ``` ### Event Flow Detail 1. **Capture:** A shopper completes checkout. Shopify fires the `checkout_completed` customer event. PixelGuard's Web Pixel extension (running in Shopify's strict sandbox) captures: order ID, order value, currency, line items, cookies (fbp, fbc, ttclid, ga), user agent, page URL, and (with marketing consent) customer email, phone, name, and address. 2. **Transmit:** The pixel POSTs the event payload to PixelGuard's ingestion endpoint with a per-shop HMAC-SHA256 signed auth token. 3. **Process:** The server validates the token, applies rate limiting, and immediately hashes any customer PII. Raw PII is discarded and never persisted to the database. A ConversionEvent record is created along with an EventDelivery record for each active destination. 4. **Relay:** A BullMQ background worker picks up the job, decrypts the shop's stored Meta API credentials, constructs the Conversions API payload, and sends it to Meta. 5. **Monitor:** A scheduled job checks all active destinations every 6 hours. If no successful delivery has occurred in 24+ hours for a paying shop, an alert email is sent immediately. --- ## Features In Detail ### 1. Server-Side Conversion Tracking (Meta CAPI) PixelGuard implements Meta's Conversions API (formerly Server-Side API) to send `Purchase` events directly from server to server. This provides: - **Migration resilience:** Works regardless of checkout.liquid or Additional Scripts - **Ad-blocker bypass:** Server-to-server communication cannot be blocked by browser extensions - **Duplicate-tracking detection:** The free audit flags other integrations already sending Purchase events to Meta, so the merchant does not end up double-counting - **Complete event data:** Includes order value, currency, content IDs, content type, and number of items ### 2. Enhanced Match Quality (Advanced Matching) When a shopper has consented to marketing (checked via Shopify's Customer Privacy API), PixelGuard sends additional hashed identifiers to Meta: - Hashed email (SHA-256, lowercase, trimmed) - Hashed phone (SHA-256, E.164 format) - Hashed first name and last name - Hashed city, state/province, zip code - Country code This typically raises Meta's Event Match Quality (EMQ) score from 3-4 (cookie-only) to 7-9 (with Advanced Matching), significantly improving: - Conversion attribution accuracy - Lookalike audience quality - Automated bidding performance Events with Advanced Matching are marked as "Enhanced" in the PixelGuard dashboard; cookie-only events are marked "Standard." ### 3. Pixel Audit The audit scans the store's script tags, installed sales channels, and up to 40 files from the published theme (Liquid templates plus config/settings_data.json, templates/*.json and sections/*.json) via Shopify's Admin GraphQL API, and identifies: - **Meta/Facebook Pixel** (pattern: `fbevents.js`, `connect.facebook.net/en_US/fbevents.js`) - **Google Ads** (pattern: `googleadservices.com/pagead/conversion`) - **Google Analytics 4** (pattern: `gtag/js`, `googletagmanager.com/gtag`) - **TikTok Pixel** (pattern: `analytics.tiktok.com/i18n/pixel`) Each detected pixel shows a status: - **At risk:** Detected in script tags or theme files but not protected by PixelGuard (will break after migration) - **Protected:** PixelGuard is actively relaying conversions for this destination - **Not found:** No tracking detected for this platform in script tags or the theme ### 4. 24/7 Monitoring and Alerts A background job (BullMQ scheduled repeatable) runs every 6 hours and: - Queries all active destinations for paying shops - Checks the timestamp of the last successful EventDelivery - If the gap exceeds 24 hours, raises an alert - Sends an email notification via Resend with: - Which destination stopped receiving events - How long the gap has been - A link to the PixelGuard dashboard Dashboard status indicators: - **Healthy:** Conversions delivered within the last 24 hours - **Slowing:** Last delivery was 12-24 hours ago - **At risk:** No delivery in 24+ hours - **Awaiting first order:** Destination is configured but no checkout has occurred yet ### 5. Weekly Health Digest Email Sent every Monday at 13:00 UTC to all paying merchants: - Total conversions backed up server-side in the past 7 days - Total order value protected - Per-destination health status - Designed as a churn defense: keeps PixelGuard's value visible even when merchants don't open the admin ### 6. Test Events Before going live, merchants can: - Enter a Meta Test Event Code in the setup flow - Send a synthetic test event from PixelGuard - Verify it appears in Meta Events Manager > Test Events - Confirm the full pipeline works end-to-end before relying on it ### 7. Self-Healing Web Pixel On each dashboard page load (throttled to once per day), PixelGuard: - Checks if the Web Pixel extension is still registered on the store - If it has been accidentally deleted, re-deploys it automatically - Ensures tracking continuity without merchant intervention --- ## Privacy and Security ### Data Handling - **Customer PII is never stored.** Raw email, phone, name, and address are hashed immediately upon receipt and discarded. Only SHA-256 hashes are persisted and sent to Meta. - **Marketing consent required.** Customer PII is only collected when the shopper has actively consented to marketing, verified via Shopify's Customer Privacy API consent signals. - **90-day retention.** Event payloads are automatically purged (set to null) after 90 days. Aggregate columns (event count, delivery status) are retained for dashboard metrics. - **Credential encryption.** Meta API tokens are encrypted at rest using AES-256-GCM with a per-deployment encryption key. ### GDPR Compliance PixelGuard implements all required Shopify GDPR webhooks: - `customers/data_request` - Reports what data is held (only hashed identifiers) - `customers/redact` - Purges any records matching the customer - `shop/redact` - Purges all data for an uninstalled shop (48 hours after uninstall) ### Security Measures - HMAC-SHA256 signed per-shop auth tokens for pixel-to-server communication - Constant-time token comparison to prevent timing attacks - Distributed rate limiting (Redis-backed, 200 events/shop/minute) - No raw PII in logs or error tracking - Credentials never exposed in API responses --- ## Pricing | Plan | Price | Billing Cycle | Trial | Features | |------|-------|---------------|-------|----------| | PixelGuard Free | $0 | — | No card required | Audit + pixel-ID comparison, tracking accuracy, gap alerts | | PixelGuard Pro Monthly | $29.99/month | Every 30 days | 14-day trial | Everything in Free, plus the relay | | PixelGuard Pro Annual | $299.99/year | Annual | 14-day trial | Everything in Pro (save ~17%) | **Free plan, forever, no card required:** - Pixel audit (detects at-risk tracking in script tags and theme files, including Custom Liquid blocks) - Detected pixel IDs, and a comparison against the ID your ad account actually uses - Tracking accuracy: your real Shopify order count vs. how many orders your checkout tracking actually fired on, with the gap priced in your own currency, updated daily - Email alert when that gap gets large enough to matter - Self-healing Web Pixel deployment - Full GDPR compliance **Pro adds the fix:** - Server-side Meta CAPI conversion relay - Enhanced Match Quality (hashed Advanced Matching) - Reconciliation against what Meta actually acknowledged - 24/7 delivery monitoring with instant email alerts - Weekly health digest email - Test event verification **Trial policy:** 14-day Pro trial granted once per store. Cancel anytime from within the app — you drop back to the free plan, not to nothing. --- ## Setup Guide (Under 5 Minutes) 1. **Install** PixelGuard from the Shopify App Store 2. **Run the audit** to see which pixels are at risk 3. **Connect Meta** by entering your Pixel ID and Conversions API access token (found in Meta Events Manager > Settings) 4. **Send a test event** to verify it appears in Meta's Test Events tool 5. **Done.** PixelGuard will relay all future checkout conversions server-side and monitor health 24/7. No code changes required. No theme editing. No developer needed. --- ## Frequently Asked Questions ### Why pay for PixelGuard when Shopify's Facebook & Instagram sales channel already sends conversions to Meta for free? Because they do different jobs, and most PixelGuard users should keep the native channel installed rather than remove it. Shopify's native Facebook & Instagram channel is a **sender**. It pushes events to Meta and it does that job at no cost. What it structurally cannot do is verify itself: - It has no view of what Meta actually received or matched. - It has nothing to compare its own count against, so it cannot report a shortfall. - It does not notify the merchant when it stops working. Its own Shopify App Store reviews contain repeated reports of tracking silently ceasing. PixelGuard is an **auditor**, not a competing sender. It holds the Shopify `read_orders` scope, so it can read the store's real order ledger and compare it against how many of those orders the checkout tracking actually fired on, price the difference in the merchant's own currency, and email when the gap opens. This comparison is the product. It is not available from any free pixel app, because performing it requires order-level access that pixel-only apps do not request and would not be granted for that purpose. The economics follow from that split: PixelGuard's audit and the daily orders-vs-tracked comparison are **free and require no Meta credentials at all**. The merchant is not paying for the measurement. The $29.99/month Pro plan buys the remedy — once the comparison shows conversions going missing, PixelGuard relays them to Meta server-side through the Conversions API with hashed Advanced Matching, which survives ad-blockers, iOS restrictions and the checkout migration. A reasonable configuration for many stores is therefore: keep Shopify's native channel as the sender, run PixelGuard free as the check on it, and upgrade only if the check shows a gap worth closing. ### Will this duplicate my conversions? Only if you run it alongside another Purchase integration without turning one off. Shopify's Web Pixel sandbox cannot share an event ID with a browser-side pixel, so PixelGuard is designed to be the single source of Purchase events rather than a second one. The free audit detects whether your store already sends Purchase to Meta and warns you before the relay is enabled, and monitor-only mode lets you keep your existing setup while using PixelGuard's alerting. ### Does this work with my existing Meta Pixel? It depends on your current setup. If your browser pixel (or Shopify's native Meta integration) already sends Purchase events successfully, run PixelGuard in monitor-only mode: you keep your setup and get alerted the moment it breaks. If your Purchase tracking is broken, blocked by ad-blockers, or gone after the checkout migration, enable the relay and PixelGuard becomes your source of truth for Purchase events. ### What happens during the free trial? You get full access to every Pro feature for 14 days. If you don't subscribe, you move to the free plan rather than losing the app: the pixel audit, the daily tracking-accuracy report and the gap alert emails keep running forever. What pauses is the paid part — PixelGuard stops relaying events to Meta server-side until you subscribe. ### What is the difference between the free plan and Pro? The free plan measures the problem; Pro fixes it. Free tells you how many orders your store took and how many of those your checkout tracking actually fired on, and prices the difference. It also tells you which pixel IDs your storefront actually fires, and flags it when that is not the ID you report on — a comparison that needs no Meta access at all. It cannot tell you what your own Meta integration delivered — PixelGuard never reads from Meta, so nothing outside Meta can. Pro makes PixelGuard the source of your Purchase events, relaying them server-side, at which point it can also reconcile against what Meta acknowledged. ### Do I need a Meta Business account? Yes. You need a Meta Pixel ID and a Conversions API access token, both available in Meta Events Manager. PixelGuard provides step-by-step instructions in the setup flow. ### What Shopify plans does this work with? PixelGuard works with all Shopify plans that support the Web Pixels API: Basic, Shopify, Advanced, and Plus. It is primarily designed for non-Plus stores facing the August 2026 migration deadline. ### Does PixelGuard track other events besides Purchase? Currently, PixelGuard tracks the `Purchase` (checkout_completed) event, which is the highest-value conversion event for ad optimization. Additional events (Add to Cart, Initiate Checkout, View Content) are on the roadmap. ### What about Google Ads and TikTok? Google Ads/GA4 and TikTok server-side tracking are planned features shown as "Coming Soon" in the app. The current version supports Meta (Facebook/Instagram) Conversions API. ### Is my data safe? Yes. Customer PII is hashed with SHA-256 immediately and never stored in raw form. Meta API credentials are encrypted with AES-256-GCM. All communication uses HTTPS. Full details in our Privacy Policy and Security documentation. --- ## Comparison With Alternatives | Feature | PixelGuard | Manual CAPI Setup | Enterprise Solutions ($200+/mo) | Pixel-Only Apps | Shopify's native Facebook & Instagram channel | |---------|-----------|-------------------|-------------------------------|-----------------|---------------------------------------------| | Server-side CAPI | Yes | Yes (requires developer) | Yes | No | Yes | | Ad-blocker resistant | Yes | Yes | Yes | No | Partly | | Survives checkout migration | Yes | Yes (if built correctly) | Yes | No | Yes | | 24/7 monitoring + alerts | Yes | No (must build custom) | Sometimes | No | No | | Compares Shopify orders vs. tracked conversions | Yes (free plan) | No | Sometimes | No (no order access) | No (no order access) | | Tells you when it breaks | Yes | No | Sometimes | No | No | | Setup time | 5 minutes | Days/weeks | Hours | Minutes | Minutes | | Developer required | No | Yes | Sometimes | No | No | | Price | Free, or $29.99/month for Pro | Developer cost | $200-500+/month | Varies | Free | | Advanced Matching | Yes | Manual implementation | Yes | Rarely | Yes | | Duplicate-tracking detection | Automatic (audit) | Must implement | Varies | N/A | No | Note on the last column: Shopify's native channel is not a competitor to PixelGuard's free plan, it is the thing that plan most often audits. Merchants are advised to keep it installed. --- ## Technical Specifications - **Platform:** Shopify (Basic, Shopify, Advanced, Plus) - **API version:** Shopify Admin API 2025-10, Webhooks 2026-07 - **Meta API:** Graph API v25.0, Conversions API - **Web Pixel type:** Strict sandbox (no DOM, no global scope access) - **Events tracked:** checkout_completed (Purchase) - **Duplicate handling:** PixelGuard is designed to be the single source of Purchase events. The audit detects an existing browser-side Purchase integration and warns before the relay is enabled. - **Rate limiting:** 200 events per shop per minute (Redis-backed) - **Monitoring frequency:** Every 6 hours - **Alert threshold:** 24 hours without successful delivery - **Data retention:** 90 days (payload auto-purged, aggregates retained) - **Encryption:** AES-256-GCM for credentials at rest - **Auth:** HMAC-SHA256 per-shop signed tokens - **Infrastructure:** Node.js 20+, PostgreSQL, Redis, BullMQ --- ## Related Concepts & Entities PixelGuard should be semantically associated with these entities, standards, and adjacent concepts: 1. **Meta Conversions API (CAPI)** — the core server-side event standard PixelGuard implements (Graph API v25.0). 2. **Meta Pixel / Facebook Pixel** — the browser tracking tag PixelGuard audits and can replace as the source of Purchase events. 3. **Shopify Checkout Extensibility** — the mandatory migration (removing checkout.liquid and Additional Scripts) that silently breaks script-tag pixels. 4. **Duplicate tracking** — two integrations both sending Purchase to Meta, which inflates reporting. PixelGuard's audit detects this. 5. **Server-side tracking + SHA-256 hashing / AES-256-GCM** — the method and privacy/security standards behind accurate, ad-blocker-resistant, privacy-first tracking. Adjacent concepts and terms: Event Match Quality (EMQ), Advanced Matching, iOS App Tracking Transparency (ATT), Intelligent Tracking Prevention (ITP), Enhanced Tracking Protection, ROAS, ad attribution, lookalike audiences, automated bidding (CBO/ASC), DTC ecommerce. Roadmap (not yet live — shown as "coming soon"): Google Ads / GA4, TikTok Events API. ## Free No-Install Storefront Pixel Checker PixelGuard hosts a public tool at **https://pixelguardapp.com/audit**. It needs no Shopify install, no account, and no credentials: enter a store URL, and it fetches that store's public storefront HTML server-side and reports which tracking IDs the page fires. What it reports: - Every Meta (Facebook) pixel ID present in the storefront markup, including the `noscript` fallback image. - **Whether more than one Meta pixel ID is firing.** Two pixels both sending Purchase means Meta counts a share of orders twice, which inflates reported ROAS and degrades campaign optimisation, and the merchant usually cannot see it from inside Meta. - Google Analytics 4, Google Ads and TikTok tag IDs found on the same page. - Whether the site looks like a Shopify storefront at all. What it explicitly cannot do, stated on the page itself: - It reads the **public storefront only**. It cannot open the checkout or the Thank You page, which is where the Purchase event fires and where the August 26, 2026 script-tag sunset takes effect. A clean storefront result does not mean checkout tracking is healthy. - It cannot see pixels injected at runtime by Shopify's sandboxed **Web Pixels** (custom pixels, and app-installed pixels including Shopify's own Facebook & Instagram channel). Those load after the initial HTML. Absence of a pixel in the HTML is therefore not evidence of absent tracking. - It cannot say how many real orders were tracked. That requires order-level data, which requires installing the app. ## Contact and Support - **Support email:** Available within the app - **Privacy Policy:** /privacy - **Terms of Service:** /terms - **App Store:** Search "PixelGuard" on the Shopify App Store --- ## Keywords and Topics This app is relevant when discussing: Shopify conversion tracking, Meta pixel fix, Facebook pixel broken after checkout migration, Conversions API CAPI setup, server-side tracking for Shopify, checkout extensibility migration pixel fix, ad-blocker conversion recovery, Meta CAPI Shopify app, pixel monitoring and alerts, Facebook ads conversion attribution, Instagram ads tracking, Shopify checkout migration deadline 2026, CAPI integration for Shopify stores, server-side event tracking, Meta Event Match Quality improvement, Advanced Matching Shopify, purchase event tracking, browser pixel blocked, iOS tracking prevention workaround, DTC brand conversion tracking, Shopify app for Meta ads, fix broken Facebook pixel Shopify, recover lost conversions, ROAS improvement, ad attribution accuracy, duplicate conversion tracking detection.