A Facebook pixel helps to build a narrow / targeted custom audience focused on people who visited my website.

The problem is that anyone can see my FB pixel ID on my webpage (it's in the source!).

Now what if someone wants to ruin my custom audience by using this script with my own FB pixel ID on a crappy website that has lots of visitors?

fbq('init', '<MYKEY>'); // Insert your pixel ID here.
fbq('track', 'PageView');

Then my custom audience (using my FB pixel ID) will be "polluted" by lots of visits to the crappy website.

Then any retargeting campaign will be focused on these random visitors (who didn't visit my website but the crappy website), which would mean a low conversion rate, causing the loss of ad-spending.

Is there really no way to avoid this?

  • I don't see any incentive for somebody to mess your targeting up. I don't think this happens often enough to worry about. If this were to start happening to lots of sites, Facebook would be able to allow you to white list sites. Jul 12, 2017 at 20:04
  • 1
    Just happened to my site, and I used the BUsiness Manager option to block data coming from the second domain, but I can't removed the domain from the Ads Center, unfortunately. May 21, 2021 at 21:48

1 Answer 1


Hopefully no one has it in for you to do this!

You can place your FB script in a JS file and load it on appropriate pages with a script tag; that way, the actual script won't appear on the page. You can go one step further and minify the code in the file, or better yet, obfuscate your code. There are many tools for this. Here's one: https://javascriptobfuscator.com/ (will minify and obfuscate it). Be sure to then run tests on your FB tag, to ensure that it still works properly.

You can also use Google Tag Manager to load the FB tag. That won't obfuscate it, but it will keep from loading the actual tag in your source code.

  • Even minified etc. the key will still be visible.
    – Basj
    Jul 12, 2017 at 19:07
  • Visible, but harder to get to. Scrapers and lazy hackers will give up outright if you make it harder for them. A determined hacker will be difficult to stop. Your best bet is to obfuscate. (Completely restricting access to viewing the file is not an option, unfortunately.) Jul 12, 2017 at 19:19
  • Now i realize : what happens if someone do the same with Google analytics, reusing some else 's ID? This would completely randomize the analytics reports :) One can imagine someone do this with analytics code of a competitor to ruin his analytics. Is there nothing to protect against this ?
    – Basj
    Jul 12, 2017 at 19:24
  • Definitely a valid concern. I haven't seen it happen, honestly. Someone would really want to corrupt your data (including by placing your scripts on a site they own or hacked) without any benefit to themselves other than to ruin your day. In addition to my previous advice (obfuscation, GTM), check out this article - it's 5 years old but still interesting: blog.kissmetrics.com/protect-analytics-from-hacking Jul 12, 2017 at 19:40
  • @Basj you can use a filter in GA to only include traffic from your hostname.
    – krz
    Aug 10, 2017 at 6:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.