COD Order Protection

Hold cash-on-delivery purchases at checkout, confirm the real orders, then send them to Meta, GA4, Google Ads and TikTok with the original order time.

Why this exists

In COD markets, a large share of orders are cancelled, refused at the door or simply fake. If you count a purchase at checkout, Meta and Google learn to find more people who place orders — including the ones who never pay. COD Order Protection counts the order only once it is real, so your ad platforms optimise for revenue you actually collect.

How it works

A customer places a cash-on-delivery order. Your GTM holds the purchase: nothing reaches Meta, GA4, Google Ads or TikTok at checkout. Prepaid orders (bKash, card, …) go out as usual.
PixelFly keeps the order in COD Held Orders: value, products, customer, cookies, click IDs and the GA client/session.
You confirm or reject it in the dashboard, or your store does it automatically through the webhook.
Confirmed: PixelFly sends the purchase, with the original order time, to your ad platforms. Rejected: nothing is sent.

Setting it up takes three steps

Work through them in order. Nothing is held until both the API key and host are filled in, so a half-finished setup never loses orders.

Turn it on in PixelFly

Below on this page. Takes a minute, and gives you the keys the next step needs.

Set up GTM, then your store

Pick your setup from the four options below, then tell your store to mark COD orders.

Confirm orders, and test

Approve in the dashboard or automatically, then check both order types before going live.

Step 1: turn it on in PixelFly

Do this before switching COD on in GTM. Every setup starts here.

Open PixelFly → your container → Power-ups → COD Order Protection and switch it on.
Choose a fire path — where confirmed orders are sent:
- sGTM /data — recommended if you have an sGTM server. Confirmed orders run your existing server tags, Google Ads included.
- Receivers — required for proxy containers. Add one Receiver per platform you want reached (Meta, GA4, TikTok, Google Ads).

Copy these four values somewhere — the next step asks for them:

Value	Looks like	Where it's used
API Key	`pf_live_…`	GTM, to hold orders
Hold URL	`https://…/cod/hold`	GTM, as the host
Webhook URL	`https://…/cod/webhook`	Auto-confirming (optional)
Webhook Secret	`pfwh_…`	Auto-confirming (optional)

The API Key is on your container page, the other three on the Power-up. These are two different secrets: the pf_live_ key holds orders, the pfwh_ secret only confirms them. Swapping them is the most common setup error.

Step 2: set up GTM

Pick the one that matches your setup. If you are not sure, you have an sGTM server if you pay for sGTM hosting or set up a server container — otherwise choose a proxy container.

Our sGTM containersYou have an sGTM server and want the fastest setup Our proxy containerNo sGTM server, and you want the fastest setup Your own sGTM containersAdd COD to server containers you already run Your own proxy containerAdd COD to a web container you already run

Then tell your store to mark COD orders: WooCommerce plugin or custom website.

Step 3: confirm orders, and test

Decide how held orders get approved — by hand in the dashboard, or automatically from your store, CRM or courier — then place one prepaid and one COD test order before you publish.

Confirming and rejecting orders · Testing and troubleshooting

Where a confirmed purchase goes

Platform	sGTM (fire path sGTM /data)	Proxy (Receivers)
Meta	Facebook CAPI tag	Meta Receiver
GA4	GA4 server tag	GA4 Receiver, with `GA4 purchase via` = `pixelfly`
TikTok	TikTok Events API tag	TikTok Receiver
Google Ads	Google Ads Conversion (COD confirmed) tag	GA4 → Google Ads import, or a Google Ads (click conversions) Receiver. One, not both

The order keeps its GA client and session IDs, so GA4 and a GA4 → Google Ads import credit the ad that brought the shopper. Google Ads needs the click ID (gclid) saved at checkout.

Worth knowing before you start

Prepaid orders are untouched. Only COD is held; everything else fires at checkout exactly as it does today.
Confirm within 7 days where you can. Meta then records the original order time (GA4: 72 hours). Later confirmations still go out, dated when you confirm.
Use one COD system only. If the GTM hold is on, the WooCommerce plugin's own legacy delay must be off, or orders are held twice.
There is a monthly limit on sending, not on holding — 50 on Free up to 10,000 on Enterprise. Over it, confirmed orders wait instead of being sent. Details.
Nothing breaks half-built. While the host or API key is still a placeholder, purchases go out as they always did.

← sGTM Variables

Our sGTM containers →