Referral tracking
How visits become referrals — first-party signed cookies, the referral window, consent gating, and privacy-safe IP handling.
How tracking works
Each affiliate gets a referral link (their dashboard shows it ready to copy). When a visitor lands through it, the plugin stores a first-party cookie on your own domain — no third-party tracking service, no data leaving your server. The cookie is signed, so it can't be forged or tampered with to claim someone else's commission.
When that visitor later places an order (or completes another commissionable event), the plugin matches the cookie, creates a referral, and shows you the originating visit — so every commission answers the question "which click earned this?".
Because tracking is first-party and server-verified, it survives the browser-privacy changes that break old-style affiliate tracking — the background is in tracking without third-party cookies.
Settings that shape attribution
Under Settings → Tracking:
- Referral window — how many days after the click a purchase still credits the affiliate. 30 days is the common default; how to choose.
- Cookie overwrite behavior — when a visitor clicks a second affiliate's link, does the new click replace the first? This is your attribution model; decide it once, publish it in your terms.
Coupon codes attribute independently of cookies — a partner's personal code credits them even when no cookie survives (cleared browser, different device, code heard on a podcast). See coupons.
Consent & GDPR
Tracking can be gated behind a consent cookie, and developers can control it precisely with the afwp_tracking_allowed filter — return false and no cookie is set, no visit recorded. Combined with the plugin's IP handling (below), most stores can run tracking as a legitimate-interest processing activity; the full picture is in data & privacy.
What gets stored about visitors
As little as possible: IP addresses are truncated and hashed before storage — the raw IP is never written anywhere. Visit data honors the retention windows you set under Settings → Data & privacy, and old rows are cleaned up automatically.
Verifying tracking works
Open an affiliate's link in a private browser window, complete a test checkout, and watch Affiliates → Referrals — the referral appears against that affiliate with its source visit. If it doesn't, check that a caching layer isn't stripping cookies or query strings, and see troubleshooting.