4

A Facebook pixel helps to build a narrow / targeted custom audience focused on people who visited my website (this is really important).

The problem is that anyone can see my FB pixel ID on my webpage (it's in the source!).

Now what if someone wants to ruin my custom audience by using this script with my own FB pixel ID on a crappy website that has lots of visitors?

<script>
!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,
document,'script','https://connect.facebook.net/en_US/fbevents.js');
fbq('init', '<MYKEY>'); // Insert your pixel ID here.
fbq('track', 'PageView');
</script>

Then my custom audience (using my FB pixel ID) will be "polluted" by lots of visits to the crappy website.

Then any retargeting campaign will be focused on these random visitors (who didn't visit my website but the crappy website), which would mean a low conversion rate, causing the loss of ad-spending.

Is there really no way to avoid this?

  • I don't see any incentive for somebody to mess your targeting up. I don't think this happens often enough to worry about. If this were to start happening to lots of sites, Facebook would be able to allow you to white list sites. – Stephen Ostermiller Jul 12 '17 at 20:04
2

Hopefully no one has it in for you to do this!

You can place your FB script in a JS file and load it on appropriate pages with a script tag; that way, the actual script won't appear on the page. You can go one step further and minify the code in the file, or better yet, obfuscate your code. There are many tools for this. Here's one: https://javascriptobfuscator.com/ (will minify and obfuscate it). Be sure to then run tests on your FB tag, to ensure that it still works properly.

You can also use Google Tag Manager to load the FB tag. That won't obfuscate it, but it will keep from loading the actual tag in your source code.

| improve this answer | |
  • Even minified etc. the key will still be visible. – Basj Jul 12 '17 at 19:07
  • Visible, but harder to get to. Scrapers and lazy hackers will give up outright if you make it harder for them. A determined hacker will be difficult to stop. Your best bet is to obfuscate. (Completely restricting access to viewing the file is not an option, unfortunately.) – Henry Visotski Jul 12 '17 at 19:19
  • Now i realize : what happens if someone do the same with Google analytics, reusing some else 's ID? This would completely randomize the analytics reports :) One can imagine someone do this with analytics code of a competitor to ruin his analytics. Is there nothing to protect against this ? – Basj Jul 12 '17 at 19:24
  • Definitely a valid concern. I haven't seen it happen, honestly. Someone would really want to corrupt your data (including by placing your scripts on a site they own or hacked) without any benefit to themselves other than to ruin your day. In addition to my previous advice (obfuscation, GTM), check out this article - it's 5 years old but still interesting: blog.kissmetrics.com/protect-analytics-from-hacking – Henry Visotski Jul 12 '17 at 19:40
  • @Basj you can use a filter in GA to only include traffic from your hostname. – krz Aug 10 '17 at 6:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.