Statically check HTML or JavaScript that reads fbclid from the URL and writes Meta's _fbc click ID cookie (and optionally _fbp). It catches the mistakes that make Meta Events Manager report a modified fbclid or attribute a conversion to the wrong ad: keeping an old click ID when a visitor arrives from a new ad, decoding, re-casing or truncating the click ID, writing creationTime in seconds instead of milliseconds, and hard-coding subdomainIndex. Rules: FBC-01: A new fbclid must overwrite an older _fbc cookie. FBC-02: Do not URL-decode fbclid a second time. FBC-03: Do not change the case of fbclid. FBC-04: Do not truncate fbclid. FBC-05: _fbc creationTime must be in milliseconds. FBC-06: Check that a hard-coded subdomainIndex matches the cookie domain. FBP-01: _fbp creationTime must be in milliseconds. Returns JSON with status ("pass", "fail", "unknown" or "not_applicable"), failed, unknown and warnings (rule IDs), and rules (one entry per rule with status "pass", "fail", "unknown" or "warn", evidence, what it protects against, severity, and a link to Meta's documentation). "unknown" means no rule failed but at least one could not decide, for example FBC-01 when it cannot tell which variable holds the fbclid from the URL. "not_applicable" means no _fbc appeared in the content, so nothing was judged. Neither is a pass. "warn" comes from a warning-level rule (FBC-06) and never changes the overall status. This is static analysis of source text, not execution: minified, bundled or obfuscated code can hide a mistake, so a pass is not proof of correctness.

Fetch a landing page and run the same checks as check_fbc_code on its HTML plus every same-origin it loads, so tracking code kept in an external file is included. Cross-origin scripts (tag managers, the Meta Pixel, analytics SDKs) are never fetched and are listed under skipped_scripts. Limits: 30 s timeout per request, at most 20 scripts, 2 MB per file. Uses a mobile Safari user agent. Only public hosts are fetched: URLs that resolve to loopback, private, link-local or other internal addresses are refused, on every redirect hop too (start the server with FBC_GUARD_ALLOW_PRIVATE=1 to check local pages). Returns JSON with status ("pass", "fail", "unknown" or "not_applicable"), failed, unknown and warnings (rule IDs), and rules (one entry per rule with status "pass", "fail", "unknown" or "warn", evidence, what it protects against, severity, and a link to Meta's documentation). "unknown" means no rule failed but at least one could not decide, for example FBC-01 when it cannot tell which variable holds the fbclid from the URL. "not_applicable" means no _fbc appeared in the content, so nothing was judged. Neither is a pass. "warn" comes from a warning-level rule (FBC-06) and never changes the overall status. Also returns final_url (after redirects), scanned_scripts and skipped_scripts.