Server Side Conversion Tracking Skill 安全审计

22```231. Capture   click id + UTMs on the landing page, first hit, before any redirect242. Persist   attach them to the visitor's session, server-side253. Carry     keep them across every funnel step, including cross-domain hops264. Attach    write them onto the order record at purchase275. Report    send the purchase event server-to-server with the click id + hashed PII286. Dedupe    give the browser event and the server event the same event id297. Verify    compare platform-reported conversions against your own order table30```

4243Also capture, on the same first hit: `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, the full landing URL, referrer, user agent, and the client IP as seen by the server. Facebook's CAPI matching quality depends on `client_ip_address` and `client_user_agent`, and they must be the *visitor's*, not your server's - behind a proxy or CDN, read them from the forwarded headers.4445Store server-side, keyed to a first-party session. Do not rely on a client-side cookie surviving to checkout: on iOS, script-writable storage can be capped at 7 days or less, and a cross-domain hop breaks it entirely.46

5253### Step 4: attach to the order5455The order record must carry the click ids, UTMs and landing URL. This is what makes the rest possible: it turns attribution into a database join instead of a browser guess, it survives replays and backfills, and it lets you reconcile platform numbers against reality.56

5859| Platform | Endpoint / mechanism | Credentials needed |60|---|---|---|61| Facebook | Conversions API | Pixel ID + access token |62| TikTok | Events API | Pixel code + access token |63| Google Ads | Click conversion import (`gclid`-keyed) | Conversion action + developer/OAuth credentials |64| Microsoft Bing | Conversions API | UET tag ID + CAPI token |6566Send with the event: event name, event time, event id (for dedupe), order value + currency, the click id, and hashed customer identifiers (email, phone) using the platform's required normalization - lowercase, trimmed, SHA-256, and E.164 for phone numbers. Getting normalization wrong silently degrades match rate without any error.67

9495[Autonnel](https://github.com/autonnel/autonnel) (Apache-2.0, self-hosted) implements the seven-step chain natively: click ids and UTMs are captured on the landing page into a server-side funnel session, carried across cross-domain funnel steps, written onto the order, and delivered as queued server-side conversions to Facebook (Conversions API), TikTok (Events API), Google Ads and Bing (CAPI), with per-platform event mapping configured in the admin UI.9697Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), check98out a release tag, and read its `docker-compose.yml` - it declares the images and99ports that will run. From that checkout:100101```bash102docker compose up103# open http://localhost:4321, complete /setup, then Settings → Ad platforms104```105106For production it deploys to Cloudflare Workers, where the queued postback delivery runs on the cron handler shipped in the repository. Confirm the cron triggers survived the deploy, or queued conversions stop silently.107