What Meta pixel for WordPress does on your site
Meta pixel for WordPress is Meta’s official plugin (listed under the Facebook name on wordpress.org) for adding the Meta pixel to a WordPress site. Once it is activated, the Settings > Meta screen shows a “Get Started” button that opens Meta’s connection flow: you pick your Business account and your pixel, then allow the site to use an access token. There is no ID to copy and no code to paste into your theme.
After the connection, the site loads fbevents.js from connect.facebook.net on every page and sends a PageView event. The plugin then adds events based on what else you run: Lead when a Contact Form 7, WPForms, Ninja Forms, Formidable Forms, Caldera Forms or Mailchimp for WP form is submitted, and ViewContent, AddToCart, InitiateCheckout and Purchase for WooCommerce and Easy Digital Downloads. The same events also go out from the server through the Conversions API, with a shared event ID so Meta does not count one action twice.
The plugin is free with no paid edition: Meta makes its money on the ads you buy on Facebook and Instagram. It shows no consent banner, and by default the pixel loads on the very first page view.
Which sites get real value from the official Meta pixel
The plugin is mainly there to measure and optimize Meta ad campaigns:
- Lead generation sites that buy Facebook or Instagram ads and want form submissions counted as conversions without setting up events by hand.
- Small WooCommerce or Easy Digital Downloads stores that want to track add to cart and purchases without syncing a product catalog.
- Sites that retarget their visitors on Facebook and Instagram based on the pages they viewed.
It is the wrong pick if you want dynamic ads built from your products: Meta for WooCommerce syncs the catalog, and while it is active, Meta pixel for WordPress stops sending its own WooCommerce events. If you also manage Google Analytics, TikTok or Pinterest tags, a multi-platform plugin such as PixelYourSite saves you from stacking tools. And if you do not advertise on Meta, the pixel gives your site nothing.
Meta pixel for WordPress strengths and limits
Strengths
- Official and free. Published and updated by Meta, with no paid tier and no locked features.
- Pixel and Conversions API without code. Meta’s flow links the pixel and the access token, and server events are deduplicated against browser events.
- Ready-made events. Lead for six form plugins, and the full purchase funnel for WooCommerce and Easy Digital Downloads.
- Built-in tester. The “Conversion API Tests” section sends a test event to Meta Events Manager.
- Staff accounts left out. WooCommerce events are not sent for accounts that can write posts or upload media.
Limits
- No consent handling. By default the pixel loads before any visitor consent; you need a consent tool to block it.
- Meta only. No other ad network or analytics tool, unlike PixelYourSite.
- Personal data in the session by default. The “Enable Events Enrichment” option, on out of the box, keeps the email, name and phone of logged-out visitors in the session.
- Few settings, English only. The advanced options come down to three checkboxes with untranslated labels.
- May deactivate after an update. The plugin’s own description warns that a known issue can deactivate it after an upgrade.
The Meta pixel settings we recommend
The advanced options appear under Settings > Meta, in the “Meta Advanced Configuration” box, once the site is connected.
| Setting | Recommended value | Why |
|---|---|---|
| Get Started (connection) Settings > Meta | The Business account that owns the pixel | Connecting a personal account or the wrong pixel sends your conversions to an ad account you do not control. |
| Filter PageView Event Settings > Meta > Meta Advanced Configuration | Off (default) | Page views feed your retargeting audiences; only check it if Meta asks you to. |
| Enable Events Enrichment Same box | Off, unless you have consent | It keeps the email, name and phone of logged-out visitors in the session to attach them to events. |
| Opt in to a Meta-enabled Conversions API integration Same box | Your call, after reading the terms | Checking it authorizes Meta to set up a Conversions API integration on your behalf, under its Platform Terms and Business Tools Terms. |
| Test Event Code Settings > Meta > Conversion API Tests | The code from Meta Events Manager | Lets you send a test event and confirm that your server is talking to Meta. |
| Automatic updates Plugins > Installed Plugins | On | The latest flaw, fixed in 5.2.2, could be triggered without an account. |
| Block until consent Your consent tool, for example Complianz | Pixel blocked until opt-in, marketing category | The plugin does not handle consent; your tool has to hold back the connect.facebook.net script. |
- In a private window, logged out, decline cookies: the page should make no request to connect.facebook.net.
- Accept cookies, then check in Meta Events Manager that the PageView comes through.
- Submit a form or place a test order while logged out: an admin account does not send WooCommerce events.
- After every update, open the Plugins page and check that Meta pixel for WordPress is still active.
Meta pixel for WordPress security: three patched flaws
Few flaws have been published for the plugin, but two were serious:
- CVE-2021-24217, fixed in 3.0.0: a function in the plugin, then called Facebook for WordPress, deserialized user-supplied data, a PHP object injection that could lead to code execution.
- CVE-2021-24218, fixed in 3.0.4: in versions 3.0.0 to 3.0.3, a CSRF flaw let an attacker save a script into the settings or delete them, because no security token was checked.
- CVE-2026-66705, fixed in 5.2.2: an XSS flaw that could be triggered without an account up to 5.2.1, as long as a logged-in user clicked a crafted link (CVSS 7.1).
Turn on automatic updates for the plugin (see our guide to automatic plugin updates) and check that it stays active afterward. Its “Meta Pixel Code” HTML comments give it away: WP Masquerade Pro removes them, which makes the plugin harder for bots to spot without fixing any flaw, and the call to connect.facebook.net, which the pixel needs, stays visible.
What WP Masquerade hides for Meta pixel for WordPress
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Meta pixel for WordPress: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- signed HTML comments
- folder name
- tag IDs
Still visible
- JavaScript variables
facebookSignalConfig, fbq - files served by the vendor
connect.facebook.net
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Meta pixel for WordPress FAQ
Does Meta pixel for WordPress cost anything?
No. The plugin is free and has no paid edition; only your Facebook and Instagram ad campaigns cost money, paid directly to Meta.
Should I run it alongside Meta for WooCommerce?
No, pick one for a store. When Meta for WooCommerce is active, Meta pixel for WordPress stops sending its WooCommerce events, and keeping both puts two pixel codes on the same pages.
Is the pixel GDPR compliant on its own?
No. The plugin does not ask visitors for consent: for European visitors, set your consent tool to block the pixel until opt-in, and describe this use in your privacy policy.
Why don’t my test purchases show up in Meta?
WooCommerce events are not sent for accounts that can write posts or upload media. Test while logged out, in a private window, with the test code from Events Manager.