The CFI Order Attribution plugin
Every setting of the WordPress plugin that records each order's ad source after consent, loads the Meta Pixel once, and keeps approved unpaid orders.
What it is
CFI Order Attribution is a free WordPress plugin for WooCommerce stores. You download it from the app and install it on your shop. It does four jobs:
- Records where each order came from, only after the shopper agrees to marketing cookies: the ad click id (Google, Meta, TikTok, Microsoft, LinkedIn, Pinterest, Snapchat), the UTM campaign tags, the landing page, the referring site, Meta's browser ids and a checkout event id. It saves this on the WooCommerce order. The app reads it through your store connection.
- Can load the Meta Pixel itself, after consent, with one event id per step so Meta counts each step once. It refuses to load a second pixel when another Meta pixel plugin is active.
- Never sends a Purchase from the shop. The app sends Purchase from its own server, only after the order is paid or the cash-on-delivery cash is settled.
- Keeps orders your team approved without payment. WooCommerce's Hold stock timer does not cancel an unpaid order that someone kept in the app (from plugin 2.4.0).
Why it matters: the browser is the only place that sees the ad click. Without the plugin, the app only gets what WooCommerce's own attribution keeps, which has no click ids and no consent decision, so such orders can never be sent back to an ad platform.
Note Example: a shop in Dhaka gets 300 web orders a month. With the plugin and a consent banner, 190 arrive with a click id and a "yes" to marketing. Those 190 can later be reported to Meta as real, paid Purchases. Without the plugin, none can.
It works with the classic checkout and the block checkout, and with both WooCommerce order storage types (including HPOS).
Who it is for
- WooCommerce shop owners and their web developer
- Shops that use the app's order attribution, ROAS report or server conversions
- Cash-on-delivery shops that want valid phone numbers at checkout
Before you start#
- WordPress 6.2 or later, PHP 7.4 or later, WooCommerce 8.2 or later.
- A WordPress administrator account.
- A consent banner that tells the plugin the shopper's choice. Tools that support the WP Consent API (for example Complianz, CookieYes, Cookiebot) are read automatically; OneTrust and Google Consent Mode are read too. Any other tool can be connected with Custom CMP variable name.
- Your WooCommerce store connected to the app, so the app can read the orders.
Step by step#
- In the app, open Integrations › CFI Order Attribution and choose Download the plugin.
- In WordPress, open Plugins › Add New Plugin › Upload Plugin, choose the zip, Install Now, then Activate.
- If WordPress shows CFI Order Attribution Setup, follow it. It checks whether a consent tool is active.
- Open WooCommerce › Settings › CFI Attribution.
- Under Privacy and consent, choose Where consent is needed, and copy the Suggested text for your privacy policy into your privacy policy.
- Under Capture Settings, keep Enable attribution capture ticked.
- Under Meta Pixel, if you use Meta ads, choose Who loads the Meta Pixel and enter Meta Pixel (dataset) id. Read "Meta Pixel settings" below first if another Meta plugin is installed.
- Choose Save changes.
- Place a test order from a tagged link, accept the banner, and check the Diagnostics section and the app's Health tab.
What each field means#
About
- Plugin version: the version installed on this shop.
Privacy and consent
- Where consent is needed: Ask everyone first (recommended) means nothing is recorded until each shopper says yes. Notice is enough outside opt-in regions means shoppers outside the EEA, UK, Switzerland, Quebec, South Korea, China, Brazil, India and Japan are measured unless they say no. Your privacy notice must say so. Those regions, and any shopper whose country can't be told, always need a yes first. The country comes from WooCommerce geolocation (WooCommerce › Settings › General).
- Suggested text for your privacy policy: a paragraph to paste into your policy.
Order quality
- Require a valid phone number: every checkout needs a phone number valid for the billing country (for example Bangladesh mobile numbers 01X XXXX XXXX). The number is also kept in international format on the order. Off by default. Useful for cash-on-delivery shops, because orders you can't reach by phone are often refused.
Capture Settings
- Enable attribution capture: the main switch.
- Attribution model: which visit wins the order's top-level record (First-touch (recommended), Last-touch, Linear, Position-based, Time-decay). The full visit history is always kept, so the app's report can use any model regardless.
- Cookie lifetime (days): how long the plugin remembers earlier visits (30 by default, 1–365).
- Extra UTM parameters: extra tags to keep besides the five standard
utm_tags, comma-separated (for example an affiliate tag). - Checkout event in the browser: sends InitiateCheckout to pixels already on the page, with consent and with the same event id the app sends from its server. Choose Off (another plugin already sends it) if another plugin sends it.
- Custom CMP variable name: only if your consent tool is not read automatically. A page variable that is "granted" or true when marketing is allowed, for example
myCmp.consent.ads. - Show UTM campaign on order screen: adds a readable campaign field to WooCommerce's own order screen.
- Post-purchase "how did you hear about us" prompt: asks How did you hear about us? (optional) on the order-received page only, never before payment.
Meta Pixel settings
- Who loads the Meta Pixel: Cash Flow Inventory (this plugin, recommended), Keep the other plugin's pixel (its Purchase event must be off), or Off (record the order data only).
- Meta Pixel (dataset) id: digits only, from Meta Events Manager. Use the same dataset as in the app.
- When the pixel loads: Only after consent (recommended), or load at once with consent revoked and grant it on consent (only if your consent tool needs the pixel present).
- The other plugin's pixel is off: tick only after you switched the pixel off in the other Meta plugin.
- Server copies from this site: also sends product viewed, added to cart and payment step from your shop's server, with the same event id, so they are counted once. Needs the token below.
- Server copy of page views: many requests for little gain; off by default.
- Conversions API token for this site: a token for the dataset. Kept on the shop only and never shown again. The app keeps its own token for order events.
- Test event code: from Meta Events Manager's Test events. Only while testing; empty it afterwards.
- Limited Data Use (US states): Automatic for US privacy states (recommended), Always or Off.
- Cash Flow Inventory sends Meta conversions: keep Ask Cash Flow Inventory (it tells this site).
The pixel fires page view, product viewed, added to cart, checkout started, payment step and order placed. It never fires Purchase. Details are in Meta: Pixel, Conversions API and catalogue.
Legacy: send checkout events from this site
Kept for shops that used it before plugin 2.0. Not needed when the app sends your conversions, which is the recommended set-up. Leave Turn on legacy sending off.
Diagnostics
Shows Capture rate (last 30 days), a 14-day capture trend and Last order with attribution, measured on the shop itself.
Daily use#
Updating the plugin
The plugin updates itself through the normal WordPress Plugins screen. Updates come only over a secure connection from Cash Flow Inventory, and a download is refused unless its checksum matches. When an update appears, update as you would any plugin.
Two Meta pixels on one shop
When Meta for WooCommerce, PixelYourSite or another pixel plugin is active, the plugin does not load a second pixel. Its notice in WordPress offers three choices in one click: use this plugin's pixel (after switching the other plugin's pixel, Purchase event and catalogue sync off), keep the other plugin's pixel (its Purchase event must be off), or no browser pixel from this plugin.
Kept unpaid orders
When your sales team approves or keeps an unpaid order in the app, the plugin stops WooCommerce from cancelling it when Hold stock runs out. The order stays Pending payment, the customer gets no e-mail, and the order page shows Kept by Cash Flow Inventory with the reason, who kept it, since when and the follow-up date. Every other unpaid order is cancelled as before.
What you see#
- In WordPress, each order with a source carries the attribution record (and the readable campaign field if you switched it on).
- In Diagnostics: the shop's own capture rate and trend.
- In the app: the Health tab, the ROAS report, and under Ad platforms › Pixel on your shop, the pixel status the app reads from the plugin each day (or with Check now).
Good practice#
- Install a consent banner before the plugin. Without one, nothing is recorded where consent is required.
- Use one Meta pixel source. Two pixels double-count every event.
- Never let another plugin send a browser Purchase.
- Keep the plugin up to date: the app's pixel health warns when the shop's plugin is older than 2.3.0.
Troubleshooting#
| What you see | Why | What to do |
|---|---|---|
| NOT loading the Meta Pixel: another Meta pixel plugin is active (see the notice). | Another pixel plugin is on | Use the notice's choice, or switch the other pixel off and tick The other plugin's pixel is off |
| Not loading the Meta Pixel yet: no pixel id. | Meta Pixel (dataset) id is empty | Enter the id from Events Manager |
| Setup says to install a consent banner | No consent tool was detected | Install one, or set Custom CMP variable name |
| Orders arrive with no source | The shopper said no, sent Global Privacy Control, or capture is off | Expected for refusals; otherwise check Enable attribution capture |
| App says The CFI Order Attribution plugin was not found on this shop. | The plugin is inactive or the shop blocks the check | Activate the plugin; check the store connection |
| App says The shop refused the connection key. | The WooCommerce REST key in the store connection was changed or removed | Reconnect the store in the app |
| Paused badge or recent failures in the legacy section | The legacy sender failed repeatedly | Turn legacy sending off; the app sends conversions |
| Phone required, but customers abroad can't check out | The number is checked against the billing country | Make sure the billing country matches the number; switch the rule off if many buyers can't give a valid local number |
Limits and what is not there yet#
- Proven against the provider's sandbox: the plugin ran in a real WordPress and WooCommerce test shop with a real browser, on both order storage types.
- The plugin header says it is tested up to WordPress 6.8 and WooCommerce 10.3, so newer WordPress may show a "not tested" note. A plugin update with newer headers, a WordPress privacy exporter and finer consent signals is planned.
- Shopify and other store platforms do not use this plugin.
Questions#
What happens to the data if I uninstall the plugin?
Uninstalling removes only the plugin's settings. The attribution on your orders stays, and your own retention rules apply.
Does the plugin send anything before consent?
No. Nothing is stored in the browser before consent, and Global Privacy Control always counts as no.
Do I still need Meta for WooCommerce?
Not for the pixel or the catalogue: the app keeps the catalogue and the plugin can load the pixel. If you keep it, switch off its pixel or its Purchase event, and its catalogue sync.
Can I use the plugin on several shops?
Yes. Install it on each WooCommerce shop connected to the business. The Health tab shows captures per store.