A visitor can land on `www.example.com` with UTM parameters and later submit a WPForms form on `quote.example.com`, a cached page, or an embedded flow. If the attribution code stores values on the wrong cookie domain, runs after the parameters are removed, waits for consent without a recovery path, or maps hidden fields incorrectly, the entry and CRM can lose the original campaign.
Use this for WPForms lead funnels that cross subdomains, use landing-page redirects, hide campaign fields, send webhooks, merge contacts in a CRM, or need separate first-touch and latest-touch attribution.
Quick answer
Define first touch and latest touch as separate immutable and updateable field groups. Capture the landing URL before redirects remove parameters, store attribution only after the applicable consent state, set the cookie scope intentionally for owned subdomains, and populate WPForms hidden fields at form render or submission. Send a unique entry ID plus both touch groups through the webhook, then verify the CRM merge preserves first touch and updates latest touch according to policy.
What to check first
- Write the exact journey with landing host, redirect, consent banner, navigation hosts, form page, iframe or embed state, submission endpoint, webhook, CRM object, and merge behavior.
- Test a clean browser with unique `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, click ID, landing timestamp, and generated journey ID.
- Inspect storage after landing, consent choice, redirect, cross-subdomain navigation, session restart, return visit, form render, and form submission without exposing unrelated cookies.
- Compare WPForms hidden-field values, saved entry, notification, webhook JSON, webhook retry, CRM lead, converted contact, duplicate merge, and opportunity attribution.
- Repeat with consent denied, consent granted late, Safari, Chrome, mobile, cache hit, ad blocker, query stripping, and an existing contact whose first touch must remain unchanged.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Define touch ownership | Write the exact journey with landing host, redirect, consent banner, navigation hosts, form page, iframe or embed state, submission endpoint, webhook, CRM object, and merge behavior. | The clean test journey preserves first-touch values from the landing host through the WPForms entry, webhook, CRM contact, and opportunity. |
| Capture before URL cleanup | Test a clean browser with unique `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, click ID, landing timestamp, and generated journey ID. | Late consent follows the documented policy, denied consent stores no prohibited identifiers, and the form still submits normally. |
| Set consent and cookie scope | Inspect storage after landing, consent choice, redirect, cross-subdomain navigation, session restart, return visit, form render, and form submission without exposing unrelated cookies. | Webhook retries and CRM merges remain idempotent, preserve first touch, and update latest touch only from the approved event. |
| Map hidden fields and webhook | Compare WPForms hidden-field values, saved entry, notification, webhook JSON, webhook retry, CRM lead, converted contact, duplicate merge, and opportunity attribution. | Chrome, Safari, mobile, cache-hit, redirect, and subdomain tests produce the expected field matrix without self-referral or duplicate-session side effects. |
Why this usually happens
- A host-only cookie set on `www` is not available when the form loads on another owned subdomain.
- A redirect or canonical cleanup removes the UTM query before the capture script runs.
- The consent callback starts analytics but never replays attribution capture from the original landing URL.
- A CRM upsert treats blank hidden fields as updates and overwrites a valid first-touch record.
Field notes
- A cookie-domain change affects privacy and security. Limit values, lifetime, hosts, access, and consent behavior to the documented business purpose.
- Use WPForms Hidden Fields and Smart Tags as transport fields, but validate server-side values because browser fields can be modified.
- Keep GA4 session attribution separate from CRM first-touch policy. They answer related but different reporting questions.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
attribution_fixture:
journey_id: UTM-20260803-A1
landing_host: www.example.com
form_host: quote.example.com
first_touch:
source: google
medium: cpc
campaign: summer_service
latest_touch:
source: newsletter
medium: email
campaign: august_followup
consent: granted
wpforms_entry_id: expected_after_submit
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Define touch ownership
- Capture before URL cleanup
- Set consent and cookie scope
- Map hidden fields and webhook
- Test CRM merge and retries
Decision rule
Preserve the first valid touch unless an approved correction process changes it. Update latest touch only from a valid new acquisition event. Never let blank values, retries, out-of-order webhooks, or contact merges erase a populated first-touch record.
What to tell the client or owner
Share the sanitized journey ID, hosts, redirect chain, consent states, cookie name and scope, hidden field IDs, WPForms entry ID, webhook event IDs, CRM merge result, and first-touch before and after values.
Production verification checklist
- The clean test journey preserves first-touch values from the landing host through the WPForms entry, webhook, CRM contact, and opportunity.
- Late consent follows the documented policy, denied consent stores no prohibited identifiers, and the form still submits normally.
- Webhook retries and CRM merges remain idempotent, preserve first touch, and update latest touch only from the approved event.
- Chrome, Safari, mobile, cache-hit, redirect, and subdomain tests produce the expected field matrix without self-referral or duplicate-session side effects.
Mistakes to avoid
- Do not use one field for both first touch and latest touch.
- Do not trust hidden fields as tamper-proof evidence.
- Do not set a broad parent-domain cookie without reviewing security, privacy, consent, and every subdomain that can read it.
- Do not overwrite attribution with blanks during a webhook retry, import, or CRM merge.
Questions teams ask during testing
Do subdomains always share cookies?
No. Cookie scope depends on how the cookie is set, browser behavior, security attributes, and consent. Test the exact hosts.
Should the form store UTM values in hidden fields?
Hidden fields are useful for carrying values into the entry and webhook, but validate them and keep a server-side evidence trail.
Is first touch the same as GA4 attribution?
No. Define CRM first touch separately and reconcile it with analytics rather than assuming identical models.
When HandL WP should help
HandL WP can trace UTM and click identifiers from landing page through WPForms, consent, cookies, webhook retries, CRM merges, and conversion reporting, then add a regression fixture for every host in the journey.
If this is active on a production site, fix WPForms campaign attribution.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references