We built a Meta Pixel auditor. Then scored our own site 28/100.

A free 2026-stack auditor for Meta Pixel + Conversions API. The 12 checks, the dogfood story (Foreground.agency itself scored 28/100 — here's what was broken), and why "AEM event prioritization" stopped being a real answer last summer.

I shipped a free Meta Pixel + CAPI auditor last week. The first thing I did was run it against foreground.agency.

Score: 28/100.

The auditor I built told me, in detail, that my own pixel had been silently throwing a JavaScript SyntaxError on every page load for the entire life of the new site. Every consenting visitor, zero pixel data. We'd been pretending we were doing iOS 14 recovery; we weren't even firing PageView.

That's the kind of mistake nobody catches with their eyeballs. The Meta Pixel Helper extension said "installed." Events Manager said "active." Our cookie banner accepted consent fine. Everything looked correct. And yet — a single malformed character had been ghosting us for months.

I fixed it. We're now at 100/100. The auditor that caught the bug is live and free at foreground.agency/tools/meta-capi-auditor.

This post is why I built it, why the audit had to be rebuilt for 2026 specifically (not 2024), and what the 12 checks actually mean for your ad spend.

The 2026 reset most agencies missed

If you Google "Meta Pixel best practices" right now, the top 10 results will tell you to "prioritize your top 8 events in Aggregated Event Measurement" and "rank your events for iOS 14+ recovery."

That advice was correct in 2022. It is wrong in 2026.

Three things shifted under the industry's feet, and most setup guides haven't caught up:

• AEM removed. Meta retired Aggregated Event Measurement and the 8-event prioritization limit in June 2025. The tab is gone from Events Manager. All eligible events now auto-aggregate behind the scenes. If a consultant is still telling you to "rank your top 8 events," they're auditing for a feature Meta deleted.
• Attribution windows shrunk. January 12, 2026: Meta permanently removed the 7-day view and 28-day view attribution windows. Reported conversions dropped 15-40% in dashboards overnight. Most marketers thought their tracking broke. It didn't — Meta just stopped counting view-through conversions the way they used to.
• One-click CAPI shipped. April 2026: Meta launched a free, no-developer Conversions API setup. Standard web events go server-side with one click. It changes the value of agency CAPI work — the floor is now free.

Plus the iOS layer kept evolving: iOS 17 introduced Link Tracking Protection (strips fbclid in Mail, Messages, Safari Private). iOS 18 expanded LTP to more contexts and rolled out aggressive Hide My Email aliasing. The "iOS 14 recovery" framing every agency still uses is three OS versions behind.

The auditor I built scores against the 2026 stack, not the 2022 one.

What it checks, and what each check costs you

Twelve checks across two tiers. Tier 1 is HTML static analysis (pixel install, OG meta, GTM container deep-scan, Advanced Matching patterns, eventID presence, Consent Mode v2, etc.). Tier 2 fires the page in a real headless browser, accepts cookie consent on your behalf, watches facebook.com/tr/ network requests, and confirms what actually fires under consenting-user conditions.

The checks ranked by what they actually move on your CPA:

1. Meta Pixel installed (15 pts). If this fails, nothing else matters. We deep-scan your GTM container too — the auditor catches pixels hidden inside tag managers, which most static checkers miss.
2. Domain verification (15 pts). Without the facebook-domain-verification meta tag, Meta silently drops every iOS 14+ event from your domain. This single check is responsible for the most cases of "my campaigns just stopped working."
3. Advanced Matching with hashed PII (15 pts). The single biggest EMQ lever. Meta's own data: lifting EMQ from 5 → 8.5 cuts CPA by \~18% and lifts ROAS \~22%.
4. fbclid first-party capture (10 pts, iOS 17/18 critical). Apple strips fbclid on the next page hop. If your server doesn't capture and persist it as a first-party _fbc cookie at landing, you lose deterministic attribution for every iOS Mail / Safari Private user.
5. eventID deduplication (10 pts). If you have CAPI without eventID, every conversion logs twice. Your reported conversion volume looks 2x healthier than reality, and Meta optimizes against the wrong baseline.
6. Consent Mode v2 (10 pts). Required for GDPR + UAE PDPL. Meta increasingly enforces it for EU traffic.
7. external\_id in AAM (8 pts, iOS 18 / Hide My Email answer). When iOS 18 hands Meta a different anonymous email alias every visit, email-based matching breaks. A stable hashed external_id is the only AAM field immune to HME rotation.
8. Pixel events firing (8 pts). Replaces the old "AEM 8-event prioritization" check. We just verify the pixel is actually emitting meaningful events. Silence = catastrophic.
9. fbclid first-party capture, runtime (6 pts). Tier-2 confirmation that the pixel fires under real consent conditions, not just that the code exists.
10. GTM container (5 pts). Useful, not signal-quality-impacting on its own. Unblocks GTM Server-Side later.
11. Apple Privacy Manifest (5 pts). Only relevant if you have an iOS app. Apple rejects app updates without the manifest declaring Meta SDK usage.
12. First-party cookies set at runtime (3 pts). Tier-2 only. Click attribution dies fast without these.

The output is a 0-100 score, an estimated Event Match Quality band (Meta's own 0-10 scale, the dial that controls ad performance), and a prioritized fix list.

The dogfood story

What broke on foreground.agency was instructive. The Pixel snippet lived inside an Astro layout file as a JSX template-literal expression wrapping a string. Astro's define:vars directive injects a const pixelId = "..." wrapper, then renders the body as-is. Our body was a JSX template-literal expression — syntax that is valid inside an Astro component file but invalid as plain JavaScript when rendered to the page.

Result: the rendered <script> had mismatched braces. Browsers threw SyntaxError: Unexpected token '{' on every consent acceptance. The pixel script's fbq() queue never got processed. No PageView. No Lead. Nothing.

Three things to take from this if you run paid Meta on a modern static site:

1. "Installed" doesn't mean "firing." Meta Pixel Helper checks for presence of the script tag, not whether the JavaScript inside it actually executed without error. Our auditor uses a real headless browser, accepts consent, and watches the network for actual tr/ calls. That's the difference between should work and does work.
2. Consent-gated pixels need separate verification. Most static checkers can't simulate accepting a Cookiebot banner. Ours does. If you're on a CMP-protected site, your usual "view source and grep for fbq" check tells you almost nothing about what consenting users experience.
3. Astro / Next / Nuxt sites are particularly exposed. SSR/SSG frameworks often inject pixels via template machinery that can produce subtly malformed JavaScript at build time. Vue and React projects have the same risk. Plain static HTML is harder to break in this specific way.

After the fix, foreground.agency runs PageView + ViewContent on every page load, eventID-deduped, with the Cookiebot consent flow respected. Score: 100/100. The auditor still flags one warning — we don't pass external_id in our Advanced Matching for iOS 18 HME-proofing — and that's on the roadmap. The auditor catches its own host's weaknesses; it would feel wrong to fudge that to 100/100.

Try it on your own site

foreground.agency/tools/meta-capi-auditor — free, no signup. Enter a URL and your email, get a score + checklist in 30 seconds. The full audit (with the runtime browser pass) takes 15-25 seconds end-to-end. We email you the report so you can forward it to your developer.

Three free audits per IP per day. Sharing the tool unlocks seven more — honor system, no enforcement, but please don't lie. The tool costs us about a tenth of a cent per audit; the bottleneck isn't compute, it's keeping the rule set honest as Meta keeps shipping platform changes.

If the result is bad and you want it fixed end-to-end, we have a productized service for that. Pixel Fix is $497 flat, 5 business days, 30-day warranty: custom events, Advanced Matching with hashed PII + external_id, iOS 17 fbclid server-side capture, offline + app event ingestion, GDPR parameter filtering (the Dresden ruling in February 2026 made this material — joint-controller liability is now a real number, not a hypothetical), and a before-and-after re-audit proving the lift. It's the layer above Meta's free one-click CAPI — same dataset, no migration, EMQ to 8+.

If you're already past the basics and want the full Tier-2 stack (GTM Server-Side on your subdomain, multi-platform routing across Meta + TikTok + Google + Snap, MMM consulting, 30-day post-launch monitoring), the iOS Recovery Engagement is $5K-15K depending on stack complexity.

Run the auditor first. If your score is above 75, you don't need us — we'll happily tell you that. If it's below 50, we both already know what's next.

Written by Foreground Digital. Start a project →

← All notes