WordPress
WordPress lead tracking without a plugin stack
One plugin, hidden fields in the form you already use, and every enquiry lands with the channel, campaign, keyword and click ID attached. No tag manager container, no dataLayer work, no analytics report to cross-reference.
WordPress
Script installed
SourceTag
Captures attribution
Your forms
Hidden fields sent
Your tools
Data arrives tagged
WordPress
Script installed
SourceTag
Captures attribution
Your forms
Hidden fields sent
Your tools
Data arrives tagged
The problem
Your WordPress site shows you the submission. It doesn't show you the ad, search or referral that sent them, so you're left guessing which marketing is actually working.
How to set it up
Drop SourceTag into your WordPress site through the WordPress plugin (or paste in your theme header). It watches how each visitor arrives, keeps that in a cookie, and writes it into your form's hidden fields the moment they submit. From there it travels wherever the form already sends data.
Grab your script tag
One line, copied from your SourceTag dashboard.
Paste it into WordPress
Go to the WordPress plugin (or paste in your theme header) in WordPress and drop the tag in.
Add hidden fields to your forms
Whatever builds your forms, add the SourceTag fields. Your form builder's setup guide has the names.
Check it works
Load the site with a UTM parameter, submit a form, and confirm the data landed.
Install the plugin and paste the Script URL
The plugin loads the tracking script on every page and, optionally, sets the attribution cookie from PHP. The second part is what makes it worth using over a raw script tag.
Upload and activate
Download the latest zip from the GitHub releases page, then Plugins > Add New > Upload Plugin. The plugin checks GitHub for updates, so WordPress tells you when a new version lands.
Paste your Script URL
Settings > SourceTag. The URL is on your site detail page in the dashboard and looks like https://cdn.sourcetag.io/scripts/YOUR_SITE_ID/st.js. Save.
Tick Enable server-side cookie setting
This re-sets the _sourcetag cookie through PHP setcookie() on every page load, so Safari treats it as a server cookie and keeps it for up to 400 days instead of seven.
Add hidden fields to whichever form plugin you run
The script finds standard HTML <form> elements and fills any input whose name matches a SourceTag field. That covers Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Formidable Forms, Ninja Forms and anything else that renders a real form.
The twelve core names are st_fc_channel, st_fc_detail_1 to st_fc_detail_4, st_fc_landing_page and the six st_lc_ equivalents. In CF7 they are [hidden st_fc_channel] shortcodes. In WPForms they are Hidden Fields with the name as the label. In Gravity Forms and Elementor they are hidden field types with the name set. Same twelve names everywhere.
Forms that appear after page load, in a popup or a slide-in, are handled too. The script watches the page for new forms and fills them when they show up.
Add the fields to every form you care about, not just the contact form. Quote requests, callback forms and newsletter signups all work from the same install, and comparing channels across one form only tells you about that form.
What gets captured
Each visit is sorted into one of eleven channels using utm_medium first, then click IDs, then the referrer. Paid Search matches on cpc, ppc, paid and similar mediums, or on the presence of gclid, msclkid, gbraid or wbraid. Organic Search matches a referrer from any of 80-plus recognised search engines, including AI answer engines. How channels work has the full priority order.
First click is written once and never overwritten. Last click updates on any later visit that brings new attribution. Both sets land on the same submission, so you can see the blog post that introduced someone and the ad that closed them.
Optional groups add click IDs, raw UTM values, and visitor meta: st_visits, st_days_to_convert, st_device, st_submit_page and st_referrer. Turn on only what you will actually read.
Values with nothing in them arrive as (not set) rather than blank. That is how you tell a genuine Direct visit apart from a field that never got filled, which saves an evening of debugging a setup that was working.
Caching is the thing that breaks it
Full-page caching serves static HTML without running PHP, so the server-side cookie refresh never fires on a cached page. Exclude pages with forms from the cache, or configure the cache to vary on the _sourcetag cookie.
Caching also explains most cases of a missing script. If the page source has no st.js after you installed the plugin, purge the cache and reload before changing anything else.
Test it
Open your site in an incognito window with UTM parameters, then go to Application > Cookies in dev tools and look for _sourcetag on your domain. It holds a JSON object with fc and lc objects inside.
Now open a page with a form, inspect the form element, and check the hidden inputs already carry values before you submit. Then submit and read the notification email. Values you should recognise: st_fc_channel reading Paid Search, st_fc_detail_1 reading google.
https://yoursite.com/?utm_source=google&utm_medium=cpc&utm_campaign=test
// or check it from the console
window.__sourcetag.getFC()If you do not want a plugin
Paste the script tag into your theme header or add it through your existing tag manager. Everything works apart from the server-side cookie, so Safari and iOS keep first click for seven days rather than 400.
You can get that back without WordPress by running the Cloudflare Worker on your domain, or by pointing the script tag's data-server-cookie attribute at an endpoint on your own site that sets the cookie via an HTTP header.
Compatible form builders
These form builders all work with SourceTag on your WordPress site. Add hidden fields to any of them and attribution data gets captured on every submission.
Frequently asked questions
Install the SourceTag plugin, add hidden fields with the SourceTag names to your forms, and every submission arrives with the channel, campaign, keyword and landing page. The values go wherever your form already sends data.
If it renders a standard HTML form with hidden fields, yes. Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Formidable Forms and Ninja Forms all do.
No. The attribution is written into the form submission itself, so it travels with the lead into your inbox or CRM rather than sitting in an analytics report you have to match up by hand.
Full-page caching can stop the server-side cookie refresh, because PHP does not run on a cached page. Exclude pages with forms from the cache or vary the cache on the _sourcetag cookie. The JavaScript side keeps working either way.
The cookie domain is detected from the hostname and set on the root domain, so www.example.com and blog.example.com share one cookie automatically. Separate top-level domains each need their own site in the dashboard.
