DEV Community: Oscar Villegas

Meta Pixel Counting Purchases Twice: Causes and How to Fix Duplicates

Oscar Villegas — Sat, 10 Oct 2026 16:52:36 +0000

Meta counts a purchase twice when the same sale reaches it from two places without a shared event_id, for example the pixel and the Conversions API, or two apps or plugins that both send Purchase. It also happens when customers return to the thank-you page from an external payment page and the pixel fires again. The fix is one source per event and the same event_id on the browser and the server event.

The usual causes

Pixel and Conversions API both send Purchase, but without the same event_id, so Meta cannot tell they are the same sale.
Two tools send the event: a platform app plus a plugin, or an app plus Google Tag Manager.
The thank-you page loads twice: after an external payment, a refresh or a return from the payment provider.
The Purchase event is set on a page that also loads for other actions.

How to check it

Compare one week of real orders against the purchases in Events Manager.
In Events Manager, open the Purchase event and look at how many events arrive from the browser and from the server, and the deduplication status.
Use the Test Events tool, make one test purchase and count how many Purchase events arrive.

How to fix it

Leave a single tool sending each event to Meta.
Send the same event_id, usually the order ID, with the browser event and the server event.
Fire Purchase only once per order, for example by checking the order ID before sending.

FAQ

Will Shopify, Meta and Google ever match exactly?

No. Each platform counts in its own way. A small, stable gap is normal; a gap above about 20% usually means something is broken.

Does deduplication need the Conversions API?

Deduplication matters when you send events from both the browser and the server. With the pixel only, duplicates come from double firing on the page.

Originally published at oscarvillegas.online. I'm Oscar Villegas and I fix this kind of problem for a fixed price: Meta Conversions API.

'There Has Been a Critical Error on This Website' in WordPress: How to Fix It

Oscar Villegas — Sat, 10 Oct 2026 16:46:33 +0000

"There has been a critical error on this website" means PHP hit a fatal error, almost always right after a plugin, theme or PHP version update. WordPress usually emails the site administrator a recovery mode link that names the plugin or theme that failed. Log in through that link, deactivate or roll back that plugin, and the site comes back; then find the real cause in the error log before updating again.

Find what broke

Check the administrator email inbox, and the spam folder, for the message from WordPress with the recovery mode link.
If there is no email, look at the PHP error log in your hosting panel. The last fatal error names the file, and the folder name tells you the plugin or theme.
If you cannot see logs, rename the plugin's folder in wp-content/plugins through FTP or the file manager. That deactivates it.

Fix it without losing content

Take a backup before changing anything.
Roll back the plugin or theme to the previous version, or deactivate it until there is a fix.
If the error started after changing the PHP version, check which plugin is not compatible with it.
Update again only after confirming compatibility, ideally on a copy of the site first.

FAQ

Will I lose my content?

No. The error stops the page from loading but does not delete posts, pages or orders.

Why did it happen if I did not change anything?

Automatic updates of plugins, themes or PHP by the hosting can trigger it without anyone touching the site.

Originally published at oscarvillegas.online. I'm Oscar Villegas and I fix this kind of problem for a fixed price: WordPress repair.

Google Ads 'Compromised Site' Disapproval: How to Fix It and Get Ads Approved

Oscar Villegas — Sat, 10 Oct 2026 16:43:08 +0000

Google Ads disapproves ads with "Compromised site" when it finds malware or hacked content on the landing page or on the domain. The ads cannot run again until the site is clean, so an appeal sent before cleaning it is rejected. Clean the site first, confirm it in Google Search Console, and then request the review from the Policy manager in Google Ads.

What Google found

The policy covers sites that were hacked to add malware, unwanted redirects, spam pages or code that harms visitors. Google may detect it on the exact landing page or on another page of the same domain, so a landing page that looks fine can still be disapproved.

Steps to get the ads running again

Check Google Search Console under Security issues for the URLs and the type of problem Google reported.
Clean the whole site, not only the landing page: files, database and any redirect.
Change every password and update WordPress, plugins and themes.
Request a review in Search Console once the site is clean.
In Google Ads, open the Policy manager, select the disapproved ads and request a review.

While you wait

If the business depends on those ads, you can point the campaigns to a clean landing page on a different domain or subdomain that is not affected, as long as it is a real page of your business and complies with Google Ads policies.

FAQ

Can I just appeal without cleaning the site?

The appeal is rejected if Google still finds the problem, and repeated rejections only delay the ads. Clean first, then appeal.

How long does the review take?

It varies. Google often answers within a few days once the site is clean.

Originally published at oscarvillegas.online. I'm Oscar Villegas and I fix this kind of problem for a fixed price: Hacked WordPress site.

WordPress Site Redirects to a Spam Site: Why It Happens and How to Fix It

Oscar Villegas — Sat, 10 Oct 2026 16:35:15 +0000

When a WordPress site redirects to a spam site, malicious code was added to the site, and it often redirects only visitors who come from Google or from a phone, so the owner does not see it. The code is usually hidden in .htaccess, in wp-config.php or a theme file, in the database (site URL options or injected scripts in posts), or in a fake plugin. Removing only the redirect is not enough; the backdoor that added it has to go too.

Why you may not see the redirect

Attackers want the redirect to last, so they hide it from the site owner. Common conditions are: only visitors coming from a search engine, only phones, only the first visit, or never when you are logged in to WordPress. Test from your phone with mobile data, opening the site from a Google search result, in a private window.

Where the redirect is usually hidden

.htaccess: rewrite rules that send search engine visitors to another domain.
wp-config.php, functions.php or index.php: obfuscated PHP, often long strings with base64_decode, eval or gzinflate.
The database: changed siteurl or home options, or script tags injected in posts, widgets and options.
A fake plugin with a plausible name that does not appear in the plugins list.
JavaScript added to the theme or to a cached file that loads the redirect from an external domain.

How to fix it properly

Take a full backup of files and database first.
Change all passwords and remove unknown admin users.
Replace WordPress core with a clean copy and reinstall plugins and themes from official sources.
Search the database for script tags and external domains you do not recognize, and check the siteurl and home options.
Check .htaccess and every PHP file in uploads, then update everything and remove plugins you do not use.
Request a review in Google Search Console if Google flagged the site.

FAQ

Why does the redirect only happen on mobile?

Many redirect scripts check the device or the referrer on purpose, so the site owner, usually on a computer and logged in, never sees it.

I removed the code and it came back. Why?

There is a backdoor somewhere else that writes the redirect again, or another infected site on the same hosting account. The cleanup has to cover files, database and every site in the account.

Originally published at oscarvillegas.online. I'm Oscar Villegas and I fix this kind of problem for a fixed price: Hacked WordPress site.

Is My WordPress Site Hacked? 9 Signs of Malware and What to Do First

Oscar Villegas — Sat, 10 Oct 2026 16:34:34 +0000

A WordPress site is probably hacked if visitors get redirected to spam, Google shows "This site may be hacked", you find administrator users you did not create, or new PHP files appear in the uploads folder. If you see any of these, do not delete things at random: take a full backup first, change every password and then clean the files and the database, because a partial cleanup usually leaves a backdoor that reinfects the site.

The 9 most common signs

Visitors, or only mobile visitors coming from Google, are redirected to casino, pharmacy or adult sites, while the site looks normal when you type the address yourself.
Searching site:yourdomain.com on Google shows pages you never wrote, often in Japanese or full of pharmacy keywords.
Google shows "This site may be hacked" under your result, or Chrome shows a red "Deceptive site ahead" page.
Google Ads disapproves your ads with the policy "Compromised site".
There are administrator users you did not create in Users, or your password suddenly stopped working.
New PHP files appear in wp-content/uploads, a folder that should only hold images and documents.
Plugins you never installed, or plugins that reappear after you delete them.
Your hosting suspends the account, warns you about malware or says the site is sending spam email.
The site became very slow or the server CPU is at 100% with no extra traffic.

What to do first, in this order

Take a full backup of files and database as they are now. It keeps your content safe and shows later how they got in.
Change every password: WordPress admins, hosting panel, FTP and the database user. Remove any admin user you do not recognize.
Check Google Search Console under Security issues to see what Google found and on which URLs.
Do not just install a security plugin and call it done. Scanners find known patterns, but backdoors are often hidden in files that look normal.
Clean the site completely: replace WordPress core with a fresh copy, reinstall plugins and themes from official sources, and check the uploads folder and the database for injected code.

How they usually get in

In our experience the most common entry point is an outdated plugin or theme with a known security hole. Next come pirated themes that already include a backdoor, passwords reused from another service, and other infected sites in the same hosting account. Closing that hole is what keeps the site clean after the cleanup.

When to ask for help

If the redirects come back after you clean them, if you cannot log in, or if your Google Ads are stopped, the infection usually has more than one backdoor. That is the point where a full cleanup by someone who reads the server logs saves time and ad spend.

FAQ

Can a security plugin remove the malware by itself?

Sometimes, for simple infections. Many hacks leave backdoors in files that look normal, so a plugin can report the site as clean while the attacker can still get in.

Will I lose my posts or orders if I clean the site?

No. A proper cleanup keeps posts, pages, products and orders. It removes infected files and injected code, after a full backup.

How long until Google removes the hacked warning?

After the site is clean you request a review in Search Console. Google usually answers within a few days.

Originally published at oscarvillegas.online. I'm Oscar Villegas and I fix this kind of problem for a fixed price: Hacked WordPress site.