WordPress / WooCommerce Plugin
Install the same-origin collector on WordPress and send WooCommerce cart, checkout and purchase events to Atribu
The Atribu Tracking Proxy plugin serves the tracker from a path on your own WordPress site (for example yourstore.com/atb) so Safari and iPhones keep recognizing returning visitors for up to 400 days instead of 7 — the same same-origin collector mechanism as the Cloudflare Worker template, packaged as a WordPress plugin so no code editing is required. With WooCommerce active, it also sends add_to_cart, checkout_started and purchase events.
Why this matters
Safari's Intelligent Tracking Prevention (ITP) deletes anything a script stores in the browser after 7 days — 24 hours if the visitor arrived from an ad click. A custom tracking subdomain does not fix this: Safari also caps a cookie set by a server outside your site's own network, and a CNAME to collect.atribu.app is exactly that. Routing through your own WordPress install is the fix — Atribu's response sets a secure, server-side cookie (atb_vid) that Safari leaves alone, because it looks exactly like any other cookie your own site sets.
| Setup | Blocks ad blockers | Survives Safari's 7-day limit |
|---|---|---|
Default (atribu.app) | No | No |
| Custom tracking domain (CNAME) | Yes | No |
| WordPress plugin (this page) | Yes | Yes |
Install
Get your tracking ID and proxy secret
In Atribu, go to Settings > Tracking > Domains > Same-origin collector and enter your site's address (https://yourstore.com) and the collector path (https://yourstore.com/atb — you can change the path later). Save. Atribu shows a proxy secret once — copy it now — and your tracking ID is on the same Tracking settings page.
Install the plugin
Download the plugin from the GitHub repository (or the WordPress.org listing, once published) and install it under Plugins > Add New > Upload Plugin, then activate it.
Configure it
Go to Settings > Atribu Tracking in your WordPress admin. Paste in your tracking ID and proxy secret, confirm the collector path matches what you entered in Atribu, and click Save Changes.
Test the connection
Click Test connection on the same page. It confirms this site's proxy reaches Atribu with the right secret — the same check Atribu's own dashboard "Check installation" button runs.
Remove any existing Atribu snippet
If you previously pasted an Atribu <script> snippet into your theme, a header/footer plugin, or Google Tag Manager, remove it. This plugin loads the tracker itself once a tracking ID is saved — two copies would double-count events.
Visitors already on your site keep their history
The first time a returning visitor reaches the new collector, their current Atribu ID becomes the long-lived one. Nobody is reset.
Behind Cloudflare (or another reverse proxy)?
By default, the plugin reads the visitor's IP address from the raw TCP connection WordPress itself received (REMOTE_ADDR) — the one value a visitor cannot fake, no matter what headers their browser sends. If your site sits behind Cloudflare (orange-cloud proxied) or another reverse proxy / load balancer, that raw connection is Cloudflare's address, not the visitor's.
Go to Settings > Atribu Tracking > Visitor IP source and switch it to match your setup:
- Cloudflare (CF-Connecting-IP) — only if the site is actually proxied through Cloudflare. Cloudflare's edge is the only thing that can set this header; if you select this on a site Cloudflare does not front, any visitor could fake their own IP by sending that header themselves.
- Reverse proxy (last X-Forwarded-For hop) — only with a trusted load balancer in front of WordPress that you know always overwrites this header rather than passing through whatever the visitor sent.
Leaving it on the default is always safe — the worst case is that reported visitor IPs are your CDN's own address rather than the real one, which only affects fraud/geo signals, never whether atb_vid gets set.
WooCommerce events
With WooCommerce active and Settings > Atribu Tracking > "Send add-to-cart, checkout and purchase events to Atribu" checked (on by default):
| Event | Fires when | Carries |
|---|---|---|
add_to_cart | A shopper adds a product to their cart (the standard AJAX "Add to cart" button) | Product ID, quantity |
checkout_started | A shopper reaches the checkout page with items in their cart | Cart total, currency, item count |
purchase | An order confirmation ("thank you") page renders, once per order | Order ID, order total, currency, and the customer's billing email/phone (sent through Atribu's identify() call, in the request body — never in a URL) |
All three fire through the same tracker script this plugin loads, so every event carries the shopper's live visitor ID and session — the sale is linked back to whichever ad, if any, brought them to your site, even if that happened days earlier.
purchase is deduplicated per order: reloading the thank-you page, or a customer revisiting an old order-confirmation link, never sends a second purchase event for the same order.
What the proxy sends, and what it does not
- It forwards only what the tracker needs: the event, the browser's user agent and language, the page address, and the visitor's IP address (so location and fraud checks keep working).
- It forwards only Atribu's own
atb_vidcookie. Your site's other cookies (logins, WooCommerce's cart/session cookies, nonces) never leave your server. - The proxy secret is stored in your WordPress database and used only from PHP, server to server. It is never sent to the browser, and the settings page never displays a previously-saved value back to you.
atb_vidholds a random visitor ID — no personal data.
Troubleshooting
"Test connection" says "Not trusted yet" — double-check the tracking ID and proxy secret match exactly what Atribu shows under Settings > Tracking, and that you saved the settings form.
The tracker script 404s — a caching plugin or CDN rule may be caching or blocking the collector path. Exclude /atb/* (or your configured path) from caching and from any "minify/combine" rule.
Changed the collector path and it stopped working — some hosts cache WordPress's permalink/rewrite rules aggressively. Saving the settings page flushes them automatically; if it still 404s, visit Settings > Permalinks and click Save Changes there too.
For developers: the proxy contract
This plugin is one of three delivery templates for the same contract: a Cloudflare Worker, a Next.js rewrite, and this plugin. See Same-Origin Collector (the "For developers" section near the bottom) for the full request/response contract, and the plugin's own source and README at integrations/wordpress/atribu/ in the Atribu repository.