Revenue Connectors · WooCommerce

Connect WooCommerce to Admaxxer

Install the Admaxxer WordPress plugin, paste two values into Settings › Admaxxer, and every paid order flows into Admaxxer with the visitor and the ad that drove it. About ten minutes, no code.

Open Integrations Back to all connectors

What you need before you start

Running more than one store? Repeat every step below on each store separately. Each store has its own Website ID and its own Signing Secret — do not reuse one store's values on another, or its orders will be refused.

Step 1 — Download the plugin

  1. In Admaxxer, open Integrations.
  2. Click WooCommerce.
  3. Download admaxxer-1.4.1.zip. You can also download it directly here: /wp-plugin/dist/admaxxer-1.4.1.zip.

The plugin is not in the WordPress.org plugin directory. Searching WordPress for “Admaxxer” under Plugins › Add New will not find it. You have to upload the ZIP by hand, which is Step 2.

Step 2 — Upload and activate it

  1. In your WordPress admin, go to Plugins › Add New › Upload Plugin.
  2. Click Choose File and pick the admaxxer-1.4.1.zip file you just downloaded.
  3. Click Install Now.
  4. When the install finishes, click Activate Plugin.

The plugin now appears in your Plugins list as Admaxxer Analytics. It does two jobs: it adds the Admaxxer pixel to your storefront, and it sends your orders to Admaxxer. Neither one starts until you finish Step 4.

Step 3 — Copy your Signing Secret

Your Signing Secret proves that an order really came from your store. Admaxxer generates it for you. You do not invent it, and there is no button in WordPress that creates one — you only ever copy it from Admaxxer into the plugin.

  1. In Admaxxer, open Integrations.
  2. Click WooCommerce, then click Connect.
  3. A card titled “Final step: webhook setup” appears with two read-only fields: Webhook URL and Signing secret.
  4. Copy the Signing secret. Leave this tab open — you need it in the next step.

Ignore the Webhook URL field. The plugin works out the address on its own from your Website ID. You do not need to copy it, and you do not need to add anything under WooCommerce › Settings › Advanced › Webhooks — that is a different WooCommerce feature and it will not deliver orders to Admaxxer.

If the connect form asks for an API key, that box is shared with our other revenue connectors and nothing reads it for WooCommerce — your orders are authenticated by the signature instead. Any placeholder value is fine.

Step 4 — Paste both values and save

  1. In your WordPress admin, open Settings › Admaxxer in the left sidebar. (It is under Settings, not under WooCommerce.)
  2. Under the General heading, paste your Website ID into the Website ID field. Include the admx_ at the front — the whole thing, for example admx_a1b2c3d4e5f6. Your Website ID is on the Dashboard › Pixel page, in the snippet line that starts data-website-id="admx_…".
  3. Under the WooCommerce heading, paste the Signing secret you copied in Step 3 into the Webhook HMAC Secret field.
  4. Click Save Settings.

Both fields are required. If either one is empty, the plugin sends nothing at all and shows no error. The pixel keeps counting visitors, so the site looks fine while orders quietly never leave. If revenue is missing, this is the first thing to check.

The other settings on that page — Proxy Origin, Enable Cookieless Tracking, Enable SPA Hash Mode — are optional and do not affect order tracking. Leave them alone unless you have a reason.

Step 5 — Verify with a test order

  1. Open your storefront in a private or incognito window and place an order, using your gateway's test mode if you have one.
  2. In Admaxxer, open Integrations › WooCommerce and look at the Recent deliveries panel. Your order should appear as the newest row, marked Accepted. If it says Rejected or nothing appears at all, the Troubleshooting section below tells you exactly what to do.
  3. Cross-check inside WordPress: open WooCommerce › Orders, click the order, and read the Order notes panel on the right. A working install writes: [Admaxxer] "purchase" event sent successfully (HTTP 200).

There is no “send a test” button anywhere — a real order through your own checkout is the test, and it is a better one, because it exercises your actual gateway.

Troubleshooting

Start at Integrations › WooCommerce › Recent deliveries. Every delivery your store attempts is listed there with its result and a plain-English reason. Find your symptom below.

“Signature did not match this site's signing secret”
The secret in WordPress is not the one Admaxxer expects. Go back to Step 3 and copy the Signing secret again, then paste it into Settings › Admaxxer › Webhook HMAC Secret and click Save Settings. Watch for a stray space at the start or end — that alone will break it. If you run more than one store, make sure you did not paste store A's secret into store B.
No deliveries at all — the panel is empty
Your store never even tried. Work through these in order:
  1. Is the plugin active? WordPress › Plugins. If Admaxxer Analytics is listed but greyed out, click Activate.
  2. Are both fields filled in? Settings › Admaxxer. If Website ID or Webhook HMAC Secret is blank, the plugin skips every order silently. Fill both and click Save Settings.
  3. Is the Website ID complete? It must include the admx_ prefix. Pasting only the part after admx_ will not work.
  4. Did the order actually get paid? The plugin sends when an order reaches the thank-you page, when the gateway confirms payment, or when the order is marked Completed. An order stuck on Pending or On hold has not triggered anything yet — mark it Completed and watch the panel.
  5. Was the order placed by hand? Orders created in WordPress under Orders › Add order do not go through checkout and may not send.
“The delivery arrived without a signature header”
Something between your store and Admaxxer removed the signature, or the plugin is out of date. Update to the latest plugin version, re-save its settings, and place another test order.
“The delivery arrived with an empty body” or “The delivery body was not valid JSON”
Another plugin or a security layer on your site is rewriting outbound requests. Temporarily disable security, firewall, or optimisation plugins one at a time and place a test order after each to find which one is responsible.
“The order was received but had no usable amount, currency, or order id”
The order reached us but had nothing to record — usually a zero-total order, a 100%-discounted order, or a test order with no line items. Place an order with a real total.
Orders show up, but with no ad source attached
The order was recorded but could not be matched to a browsing session. The plugin reads a first-party cookie the pixel sets when someone visits your site, and matches on the customer's email if the cookie is missing. Expect this for phone orders, orders you key in yourself, and subscription renewals — nobody browsed, so there is nothing to match to. If it happens to normal storefront orders, the pixel probably is not running: confirm visitors are appearing in your dashboard, and check whether a consent banner or ad blocker is stopping the pixel from loading.
A delivery says “Duplicate”
Nothing is wrong. More than one of the three triggers fired for the same order, which is normal and expected. Admaxxer counts the order once. You do not need to do anything.
You want the raw delivery log from your own server
The plugin records every attempt in WordPress under WooCommerce › Status › Logs, in the log named admaxxer. It also writes a note on each order with the result. Useful when you want to prove the request left your site.

How it works under the hood

You do not need any of this to set the plugin up — it is here for developers and for anyone auditing what leaves their store.

What triggers a send

If several triggers fire for one order you still get one row. The plugin refuses to send the same order and event twice, and Admaxxer separately ignores an order id it has already recorded.

Where it sends

The plugin builds this address from the Website ID you pasted in Step 4:

https://admaxxer.com/api/pixel/webhooks/woocommerce/<YOUR_WEBSITE_ID>

How it is signed

Each request carries an X-Admaxxer-Signature header holding an HMAC-SHA256 of the exact JSON body, keyed with your Signing Secret, in the form sha256=<hex digest>. Admaxxer recomputes the digest and compares it in constant time. There is no timestamp in the payload and no replay window — the signature is the entire check.

What a refused delivery returns

How the order is matched to a visitor

The Admaxxer pixel sets a first-party cookie when someone visits your store. At checkout the plugin reads that cookie, saves it on the order, and sends it as admx_visitor_id. If the cookie is missing, Admaxxer falls back to matching on the customer's email address. If neither is available the order is still recorded as revenue — it just has no ad source attached to it.

What each order sends

Beyond the total and currency, the plugin sends the subtotal, tax, discount, shipping, refunded amount, units sold, line-item count, gross sales, whether the buyer is new, their lifetime order count and spend, payment status, fulfilment status, gateway, billing and shipping country, per-item detail (SKU, quantity, price, discount), and WooCommerce's own first-touch attribution data on WooCommerce 8.5 and newer. That is what fills in the product and customer tiles on your dashboard.

Frequently asked

Where do I get the Signing Secret — do I create it myself?
Admaxxer creates it for you. You never type a secret into Admaxxer and there is no Generate button in WordPress. Open Admaxxer, go to Integrations, click WooCommerce, then Connect. The card titled 'Final step: webhook setup' shows two read-only fields: Webhook URL and Signing secret. Copy the Signing secret and paste it into WordPress under Settings > Admaxxer > Webhook HMAC Secret. The copy only ever goes one way: from Admaxxer into the plugin.
Why is nothing arriving from my store?
In almost every case one of the two required fields is empty. Open Settings > Admaxxer in WordPress and check that Website ID and Webhook HMAC Secret are both filled in, then click Save Settings. If either one is blank the plugin sends nothing at all and reports no error — the pixel keeps recording pageviews, so the site looks healthy while orders quietly never leave. Also confirm the plugin is Activated under Plugins, and that the order actually reached a paid or completed status.
Do I have to paste the Webhook URL anywhere?
No. The plugin builds the destination URL itself from your Website ID, so the Webhook URL field in Admaxxer is there for reference only. You do not need to create a webhook under WooCommerce > Settings > Advanced > Webhooks — that is a different system and it will not work for this integration. Pasting the Signing Secret and the Website ID is the whole job.
Do I need to enter an API key to connect WooCommerce?
No. The connect form shows a generic API key box because it is shared with other revenue providers, but WooCommerce authenticates every delivery with the HMAC signature instead — nothing reads that key for WooCommerce. You can put any placeholder value in it. The two values that actually matter are the Website ID and the Signing Secret, both pasted into WordPress under Settings > Admaxxer.
Which WooCommerce events does the plugin send?
Three: woocommerce_thankyou and woocommerce_payment_complete both send a 'purchase' event, and woocommerce_order_status_completed sends a 'completed' event. Between them they catch card gateways, PayPal and Stripe redirect flows where the shopper never returns to the thank-you page, and manually-completed bank transfer or cash-on-delivery orders. If all three fire for one order you still get one row: the plugin refuses to send the same order and event twice, and Admaxxer independently ignores an order id it has already recorded.
How does the signature work?
The plugin computes an HMAC-SHA256 of the exact JSON body it is about to send, using your Signing Secret as the key, and puts the result in the X-Admaxxer-Signature header in the form sha256=<hex digest>. Admaxxer recomputes the same digest and compares the two in constant time. If they do not match the delivery is refused with HTTP 400 and the reason bad_signature. There is no timestamp in the payload and no replay window — the signature is the whole check.
Does this work with WooCommerce Subscriptions?
Renewal revenue arrives, but renewals are usually not tied back to a visitor. Each renewal creates a new order, which fires woocommerce_payment_complete, so the money is recorded. However the plugin reads the visitor from the shopper's browser cookie at checkout, and a renewal is billed in the background with no browser present, so there is no cookie to read. Renewals are matched by email when the shopper's email is on the order; otherwise they land as revenue without an ad source attached.
Does the plugin work with High-Performance Order Storage (HPOS)?
Yes. The plugin declares HPOS compatibility on WooCommerce's before_woocommerce_init action and uses WooCommerce's standard order functions, so it works on both the legacy orders table and HPOS. You do not need to change any setting when you migrate between the two.
Which WordPress and WooCommerce versions are supported?
The plugin requires WordPress 5.8 or newer and PHP 7.4 or newer. It requires WooCommerce 3.0 or newer and is tested up to WooCommerce 9.0. It is not distributed through the WordPress.org plugin directory — searching the directory for it will not find it. Download the ZIP from your Admaxxer dashboard under Integrations > WooCommerce and upload it by hand.
Where is the Signing Secret stored on my site?
In your WordPress options table, the same place every other plugin setting lives, and it is not encrypted at rest. Treat it the way you would treat a password: anyone who can reach your WordPress admin or your database can read it. If you believe it has been exposed, disconnect and reconnect WooCommerce in Admaxxer to issue a new secret, then paste the new value back into Settings > Admaxxer.

Next steps