WordPress & WooCommerce install guide

WordPress is the stack where first-party attribution is genuinely easy, and where almost nobody does it — because every plugin in the ecosystem reaches for a JavaScript tag first.

You have PHP running on every request, on your own domain, with hooks for every meaningful event. Use them.

1. Set a durable first-party cookie

// wp-content/plugins/flowsk/flowsk.php
add_action('init', function () {
  if (empty($_COOKIE['_fsk_id'])) {
    $id = wp_generate_uuid4();
    setcookie('_fsk_id', $id, [
      'expires'  => time() + 63072000,  // 2 years
      'path'     => '/',
      'samesite' => 'Lax',
      'secure'   => is_ssl(),
      'httponly' => false,              // the snippet reads the same id
    ]);
    $_COOKIE['_fsk_id'] = $id;          // available on this request too
  }
});

Because PHP writes this in the HTTP response, Safari’s seven-day cap on JavaScript cookies does not apply. Three lines, and you are ahead of most instrumented sites on the internet.

2. Load the snippet

add_action('wp_head', function () {
  $key = defined('FLOWSK_WRITE_KEY') ? FLOWSK_WRITE_KEY : '';
  if (!$key) return;
  printf(
    '<script async src="https://flowsk.com/flowsk.js" data-write-key="%s"></script>' . "\n",
    esc_attr($key)
  );
}, 1);  // priority 1 — before other plugins' tags

3. Confirm the purchase (WooCommerce)

add_action('woocommerce_payment_complete', function ($order_id) {
  $order = wc_get_order($order_id);
  if (!$order) return;

  flowsk_server_event([
    'source'      => 'server',
    'category'    => 'purchase',
    'name'        => 'purchase',
    'email'       => $order->get_billing_email(),
    'value_cents' => (int) round($order->get_total() * 100),
    'dedup_key'   => 'wc_order_' . $order_id,
  ]);
});

function flowsk_server_event($event) {
  wp_remote_post('https://flowsk.com/api/events', [
    'timeout'  => 5,
    'blocking' => false,   // do not make the shopper wait
    'headers'  => ['Content-Type' => 'application/json'],
    'body'     => wp_json_encode([
      'write_key'    => FLOWSK_WRITE_KEY,
      'anonymous_id' => $_COOKIE['_fsk_id'] ?? null,
      'events'       => [$event],
    ]),
  ]);
}

'blocking' => false matters — a slow HTTP call inside a payment hook is a checkout you just made worse.

4. Identify on registration and forms

// Account creation
add_action('user_register', function ($user_id) {
  $user = get_userdata($user_id);
  flowsk_server_event([
    'source'    => 'server',
    'category'  => 'identification',
    'name'      => 'signup_started',
    'email'     => $user->user_email,
    'dedup_key' => 'wp_user_' . $user_id,
  ]);
});

// Contact Form 7 — on confirmed send, not on submit
add_action('wpcf7_mail_sent', function ($form) {
  $data = WPCF7_Submission::get_instance()->get_posted_data();
  flowsk_server_event([
    'source'   => 'server',
    'category' => 'identification',
    'name'     => 'lead_captured',
    'email'    => $data['your-email'] ?? null,
  ]);
});

Gravity Forms uses gform_after_submission; Ninja Forms uses ninja_forms_after_submission. The principle is the same everywhere: fire on the confirmed submission, never on focus or on submit-attempt.

The caching problem

This is the one that catches people. A full-page cache plugin (WP Rocket, W3 Total Cache, LiteSpeed, or your host’s edge cache) serves a stored response — including, potentially, a Set-Cookie header generated for a completely different visitor.

Three ways out, best first:

1. Exclude the cookie from cache. Most plugins let you list cookies that bypass the cache or headers to strip.
2. Set the id from a tiny uncached endpoint the snippet calls once (/wp-json/flowsk/v1/id).
3. Set it at the edge — a Cloudflare Worker in front of WordPress, which never touches PHP.

Verify with the cookie inspector: load your site twice in private windows and confirm you get two different _fsk_id values. If you get the same one, your cache is serving someone else’s cookie.

Plugin hygiene

Fire at priority 1. Other plugins inject tags too; being first means you capture the landing URL before anything rewrites it.

Expect duplicate hooks. If two analytics plugins listen to woocommerce_payment_complete, both fire. The dedup key makes that harmless — which is a good reason to always set one.

Use a site-specific plugin, not functions.php. Theme changes should not remove your measurement.

Filter test orders before sending, or your first week will look implausibly good.