1. Getting Started

1.1 Overview & Architecture

Ad-blockers, Safari Intelligent Tracking Prevention (ITP), and iOS privacy restrictions now block 25% to 40% of standard client-side tracking pixels. Traditional OpenCart extensions simply paste browser scripts into the header, resulting in broken attribution, inaccurate ROAS, and depressed Meta Event Match Quality (EMQ) scores.

eWeb Server-Side Tracking (eweb_tracking) solves this by capturing commerce actions on the PHP backend, securely normalizing and hashing customer PII (SHA-256), and dispatching asynchronous server-to-server requests:

• Full Event Deduplication: Both browser and server events carry identical event_id tokens, preventing double counting in ad platforms.
• Order-Bound Identity: Click IDs (fbclid, ttclid, gclid) captured upon landing are stored with the order. Offsite payments (PayPal, Stripe Checkout) are fully tracked even if the customer closes their browser before returning.
• Zero TTFB Overhead: Dispatches asynchronously post-response via fastcgi_finish_request and an automated background retry queue.

Figure 1.1 — Real-time event debugger verifying server-to-server dispatch with Event Match Quality (EMQ) analysis.

1.2 System Requirements

1.3 Installation & First-Time Setup

1. Upload eweb_tracking.ocmod.zip via Extensions → Installer.
2. In OpenCart 3: Refresh Modifications in Extensions → Modifications.
3. Go to Extensions → Extensions → Modules, locate eWeb Server-Side Tracking, and click Install.
4. Click Edit to open the Central Dashboard. Set status to Enabled and input your ad platform credentials. Each credential field links to the console where that id lives, and to the matching section of this guide.

Purchase and refund statuses

Purchase fires once when an order enters a status listed in Purchase Statuses. Leave the field empty to use the shop’s Processing and Complete statuses. Refund fires for statuses in Refund Statuses. Leave that empty to match statuses named Refunded, Reversed, or Chargeback. The numbers are the ids in System → Localisation → Order Statuses.

Browser companion

loader injects the destination pixel loaders and shares event ids with the server so browser and server hits deduplicate. adopt only pushes a dataLayer event for a pixel or GTM container you already installed. off is server only.

Collect endpoint secret

Generated on install. It signs the browser collect endpoint and the worker URL. Do not publish it.

Figure 1.2 — Unified destination configuration panel in the eWeb Central Dashboard.

1.4 Licensing & Pricing

eWeb Server-Side Tracking is available on the OpenCart.com Marketplace for $59 (one-time purchase including 12 months of premium support and free updates). A Cloud SaaS subscription is also available at $19/month.

2. Meta Conversions API (CAPI)

2.1 Dataset ID & Access Token

If you are already logged in, Events Manager opens on your pixels. From there you can copy an existing Pixel ID or create one (Connect data sources → Web).

How to copy the Pixel / Dataset ID

1. Open Meta Events Manager.
2. Select the business, then Data sources.
3. Select the Pixel (dataset), or create a new web pixel.
4. Open the Settings tab and copy the numeric Dataset ID / Pixel ID (15–16 digits) into Meta Pixel ID.

How to generate the access token

1. Stay on that pixel’s Settings tab.
2. Scroll to Conversions API → Set up direct integration.
3. Click Generate access token and paste it into Meta CAPI Access Token.

The token is stored in the shop database. Restrict admin access. It does not expire unless you revoke it.

Additional pixels

One pixel per line: pixel_id|access_token|test_code|events. The events list is optional; leave it empty to send every event. Create each extra pixel in the same Events Manager.

2.2 Test Event Code Verification

In Meta Events Manager → Test Events, copy your 8-character server test code (e.g. TEST12345) and paste it into OpenCart settings. Place a test order to verify server events show up with green Server badges. Clear the field when done.

2.3 Maximizing Event Match Quality (EMQ 8.5–9.5)

eWeb Tracking automatically hashes customer parameters using lowercase SHA-256 algorithms per Meta's exact specifications:

2.4 Meta Limited Data Use (LDU)

Turn on Meta Limited Data Use when you need California CCPA / US state privacy handling. The module then sends data_processing_options with automatic geo. LDU still applies when the consent policy is set to always.

3. TikTok Events API v1.3

Logged-in users open TikTok Events Manager on their web events.

How to copy the Pixel code

1. Open TikTok Events Manager (Tools → Events).
2. Under Web Events, select the pixel, or create one.
3. Copy the Pixel ID into TikTok Pixel Code.

How to generate the access token

1. Open the pixel → Settings.
2. Under Events API, click Generate Access Token.
3. Paste it into TikTok Access Token.

How to test events

In Events Manager open Test events, copy the test code into TikTok Test Event Code, and save. Browse the store, confirm the events, then clear the code before going live.

3.2 Standard Purchase Events

Purchase uses the current standard event name Purchase. Value, currency, and contents come from the OpenCart order. The same event_id is shared with the browser pixel so TikTok deduplicates.

3.3 Click ID (ttclid) Binding

The landing URL parameter ttclid and the first-party cookie _ttp are stored with the visitor and attached to later server events, including purchases completed on an offsite payment page.

4. Google Analytics 4 (GA4) Measurement Protocol

Logged-in users open Google Analytics on their property, then Admin → Data streams.

Where to find the Measurement ID

1. Open Google Analytics.
2. Click Admin (gear, bottom left).
3. Under Data display, open Data streams.
4. Open the Web stream and copy Measurement ID (G-XXXXXXXXXX).

How to create the API secret

1. On that same web stream, open Measurement Protocol API secrets.
2. Click Create, nickname it (for example eWeb Server Tracking), and save.
3. Copy the secret value into GA4 API Secret. Google shows it only once.

Figure 4.1 — Storefront tracking bridge injecting client dataLayer tokens and matching server event IDs.

4.2 Hybrid vs. Server-Only Mode

Server only sends every event from PHP. The companion still reads the _ga client id so hits stay in one session. Off does not call GA4.

4.3 Session Stitching & DebugView

Turn on GA4 Debug View to send events to the validation endpoint. Watch them in Analytics → Admin → DebugView, then turn it off for production collection. In server-only mode the _ga client id and the stream session cookie are read so server hits join the same session.

5. Matomo & Generic Webhooks

Site ID and the auth token live in your own Matomo, not in a shared console. Cloud accounts start at Matomo Cloud.

Matomo URL

The base URL you log into, for example https://analytics.example.com.

How to find the Site ID

In Matomo open Administration → Websites (Measurables). The numeric id next to this shop is Matomo Site ID.

How to create the auth token

Open Administration → Personal → Security → Auth tokens → Create new token. The token needs write permission so queued hits can set the visitor time and IP.

5.2 Custom JSON Webhook Triggers

Every event can be posted as JSON to PostHog, Plausible, Umami, n8n, Zapier, or your own endpoint. Pick a preset or supply a template.

Endpoint URL

Paste the HTTPS URL that should receive the payload. For n8n or Zapier that is the webhook URL the workflow shows you.

Signing secret

Optional. When set, each request includes X-Eweb-Signature, an HMAC-SHA256 of the raw body. Verify it on the receiver before trusting the payload.

6. Consent Mode v2 & GDPR

The module automatically reads consent cookies from Cookiebot, CookieYes, Complianz, and OneTrust, transmitting ad_storage, analytics_storage, and ad_user_data signals.

Default Analytics Consent and Default Ad Consent apply only when no CMP cookie is present. ON means granted. Region policy strict_eea denies marketing and analytics for EEA, UK, and Switzerland visitors until a CMP grants; global uses the defaults everywhere.

6.2 CMP Detection (Cookiebot / CookieYes)

Cookiebot, CookieYes, Complianz, and OneTrust cookies are read before the Google Consent Mode defaults. A granted CMP cookie wins over the admin defaults. The consent state is snapshotted onto the order so an offsite payment callback, which has no browser cookies, still uses the consent the customer gave at checkout.

6.3 IP Truncation & Privacy Policies

IP Address Policy: full sends the visitor IP, truncated masks IPv4 to /24 and IPv6 to /48, none never sends an IP. Identity rows (click ids, IP, user agent) are purged after Identity Retention days.

7. Dashboard & Diagnostics

Figure 7.1 — Live OpenCart catalog triggers and inter-plugin hooks overview.

The Recovered Conversions panel highlights sales recovered from ad-blockers, while Order Reconciliation allows safe backfilling of missing conversions.

7.2 Recovered Conversions Report

Compares orders that produced a server purchase with orders whose browser pixel never confirmed. Use it to see revenue that client-side pixels missed.

7.3 Live Event Debugger

The debugger lists recent dispatches, the destination response, and the match keys that were sent. Customer emails and phone numbers are shown only as hashes.

7.4 Order Reconciliation & Backfill

When a purchase status was reached before the module was installed, reconciliation can queue that order once. An order that already sent a purchase is not sent again.

Figure 7.2 — Diagnostics, rotating debug logs, and multi-layer cache drivers.

8. Developer Hooks & Destination SDK

Filter outgoing events with native actions & filters:

$ctx = \Eweb\Core\Core::ctx('eweb_tracking');

// Intercept and enrich canonical event
$ctx->hooks()->addFilter('eweb/tracking/event', function ($event) {
    return $event->withCustom(['loyalty_tier' => 'VIP_GOLD']);
});

8.2 Destination SDK

A destination receives the same canonical event the built-in Meta, TikTok, GA4, Matomo, and webhook destinations receive. Register it from the plugin bootstrap so it joins the queue, retry, and consent rules instead of calling an ad platform from a theme template.