This week’s teardown comes from a real HandL WP scan. Names, domains, and IDs are stripped. The pattern is common: paid traffic reaches the page with click details, but the contact form submits without adding them to the lead record.
When that happens, your CRM shows “a lead.” Your ad account shows “a click.” The form record cannot connect the two.
What leaked
- Leak type: missing first-party attribution fields on form submit.
- Vendor class: lead form + ad click IDs (UTM parameters, Google click id, HandL-style hidden fields).
- Platform: WordPress-style contact form on a marketing site.
The scanner’s “hidden attribution fields at submit time” check failed: when the bot reached submit, the form had no utm_*, gclid, or HandL-style hidden inputs. A Meta Pixel signature was present on the page, but that alone does not prove an event fired. The confirmed failure was the missing attribution fields at submit.
Who could see it
- Browser — may still hold click details from the landing visit.
- Form endpoint — received no hidden campaign or click-ID fields at submit.
- Site owner reporting — cannot connect the lead to a campaign from the form record alone.
This was not a privacy leak to an unknown third party. It was an attribution gap: the lead arrived without the data needed to connect it to a campaign.
How we found it
Our free checker walks a short visitor journey, fills the lead form when it can, and inspects the DOM at submit. Check B12 — Hidden attribution fields at submit time fails when that snapshot has no attribution-like hidden fields. Sister checks can still pass (landing URL accepts UTMs; cookies retain click ids) — which is exactly how this pattern hides in dashboards that only look at the browser.
The fix
- Add hidden fields for at least
utm_source, utm_medium, utm_campaign, and gclid (plus your CRM’s click-id field if it differs).
- Populate them on first landing from the query string, then keep them across internal navigation (plugin, tag manager data layer, or first-party script).
- Confirm the values are still present in the DOM at submit, not only in cookies.
- Send a test lead from a tagged URL and verify the CRM row shows the same values.
- Re-run the checker and expect B12 to pass.
Before / after (evidence style)
- Before: B12 fail — “No utm/gclid/handl-style hidden fields on the form when the bot submitted.” Pixel/tag checks may still look fine.
- After: B12 pass — hidden fields present at submit with the test campaign values; CRM shows the same campaign on the test lead.
Describe that delta in your own notes. Do not publish screenshots that show a real domain, logo, or pixel ID.
Run this check on your own site
Paste your URL into the free Ad Attribution Leak Finder. Read the Forms and Tracking sections together — a green pixel with a red “hidden fields” row is this week’s pattern.
Keep watching your site
Leak Watch re-scans your site and emails you when the score or checks change. Start with free monthly checks or upgrade to weekly monitoring.