Using Custom Hidden Fields in Website Forms to Capture UTM Parameters Without User Knowledge

How UTMs Die: The Standard Failure Mode

Three observations about the attribution problem:

Observation 1: URL parameters don’t persist across pages

UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) live in the URL query string. They exist on the landing page only. The moment the user clicks any internal link, the new page’s URL doesn’t carry the UTMs forward. Unless explicit preservation code intercepts and propagates them, they’re gone the moment the user navigates internally.

Observation 2: Forms by default only capture what’s on the current page

If the form is on the same page as the UTMs (single-page landing pages with form in the hero), capture is automatic — the form reads URL parameters or hidden fields populated from URL. For B2B sites where users browse multiple pages before filling forms (case studies → pricing → demo request), the form is rarely on the original landing page. By the time the form is rendered, UTMs are gone from the URL.

Observation 3: Most analytics tools attribute incorrectly without help

Google Analytics 4 has improved UTM attribution but still struggles with multi-session journeys. HubSpot’s built-in source tracking attributes "first touch" but can be confused by single-page apps and dynamic forms. Salesforce out-of-the-box has NO UTM capture — it’s entirely up to your integration to feed UTMs in. The default behavior of most tools is "lose UTM attribution silently."

The Implementation Checklist: 6 Hidden Field Capture Steps

Step 1: GTM Custom HTML tag (fires on all pages)

JavaScript that runs on every page load. Reads URL parameters, stores them in cookie if present.

<script>
(function() {
  var utmKeys = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content'];
  var params = new URLSearchParams(window.location.search);
  var captured = {};
  utmKeys.forEach(function(k) {
    if (params.has(k)) captured[k] = params.get(k);
  });
  if (Object.keys(captured).length === 0) return;
  
  // Always update last-touch
  var expiry = new Date();
  expiry.setTime(expiry.getTime() + (90 * 24 * 60 * 60 * 1000));
  utmKeys.forEach(function(k) {
    if (captured[k]) {
      document.cookie = 'last_' + k + '=' + encodeURIComponent(captured[k]) + 
                        ';expires=' + expiry.toUTCString() + ';path=/;SameSite=Lax';
    }
  });
  
  // First-touch: only set if cookie doesn't exist yet
  utmKeys.forEach(function(k) {
    if (!document.cookie.match(new RegExp('first_' + k + '=')) && captured[k]) {
      // First-touch expiration: 365 days (longer to capture original source)
      var firstExpiry = new Date();
      firstExpiry.setTime(firstExpiry.getTime() + (365 * 24 * 60 * 60 * 1000));
      document.cookie = 'first_' + k + '=' + encodeURIComponent(captured[k]) + 
                        ';expires=' + firstExpiry.toUTCString() + ';path=/;SameSite=Lax';
    }
  });
})();
</script>

Step 2: Hidden form field population

On form rendering (or before submission), populate hidden fields from cookies. Add to GTM or directly in your form HTML.

<script>
function getCookie(name) {
  var m = document.cookie.match(new RegExp('(^|;)\s*' + name + '=([^;]+)'));
  return m ? decodeURIComponent(m[2]) : '';
}
function populateUTMFields() {
  ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content'].forEach(function(k) {
    var firstField = document.querySelectorAll('input[name="first_' + k + '"]');
    var lastField = document.querySelectorAll('input[name="last_' + k + '"]');
    firstField.forEach(function(f) { f.value = getCookie('first_' + k); });
    lastField.forEach(function(f) { f.value = getCookie('last_' + k); });
  });
}
if (document.readyState === 'complete') populateUTMFields();
else window.addEventListener('load', populateUTMFields);
// Also re-populate on form interactions for SPA scenarios
document.addEventListener('focusin', function(e) {
  if (e.target.tagName === 'INPUT' || e.target.tagName === 'TEXTAREA') populateUTMFields();
});
</script>

Step 3: Hidden field HTML in your forms

Add these to every form on your site. Hidden fields don’t affect user UX; they sit invisibly and submit with the rest of form data.

<!-- First-touch UTMs (immutable original source) -->
<input type="hidden" name="first_utm_source" value="">
<input type="hidden" name="first_utm_medium" value="">
<input type="hidden" name="first_utm_campaign" value="">
<input type="hidden" name="first_utm_term" value="">
<input type="hidden" name="first_utm_content" value="">

<!-- Last-touch UTMs (most recent touch) -->
<input type="hidden" name="last_utm_source" value="">
<input type="hidden" name="last_utm_medium" value="">
<input type="hidden" name="last_utm_campaign" value="">
<input type="hidden" name="last_utm_term" value="">
<input type="hidden" name="last_utm_content" value="">

<!-- Also capture GCLID/fbclid for ad platform attribution -->
<input type="hidden" name="gclid" value="">
<input type="hidden" name="fbclid" value="">

Step 4: CRM custom fields

Create matching custom fields in your CRM. HubSpot example:

• First Touch UTM Source (single-line text, contact property)
• First Touch UTM Medium
• First Touch UTM Campaign
• First Touch UTM Term
• First Touch UTM Content
• Last Touch UTM Source
• Last Touch UTM Medium
• Last Touch UTM Campaign
• Last Touch UTM Term
• Last Touch UTM Content

For Salesforce: same fields on Lead, Contact, and Opportunity objects. Critical: ensure field mapping when Lead converts to Contact/Opportunity (Salesforce default lead conversion can drop custom fields).

Step 5: First-touch immutability rule

First-touch fields should be SET-ONCE. After initial capture, subsequent visits should not overwrite. Implementation:

• Client-side: JavaScript checks if first_utm_source cookie exists; only sets if absent
• CRM-side: field workflow rule prevents updates to first_touch fields once populated
• Marketing automation: HubSpot/Marketo can enforce "set once, then read-only"

The most common implementation mistake: first-touch fields getting overwritten by subsequent touches, destroying long-term attribution.

Step 6: Lifecycle propagation

UTMs must propagate from Lead → Contact → Opportunity → Closed Won. Ensure:

• Salesforce: lead conversion mapping includes both first-touch and last-touch UTM fields
• HubSpot: deal records inherit UTMs from associated contact
• Reporting: closed-won deals show their UTM attribution for ROI analysis

Implementation by Form Platform

HubSpot Forms

• Native UTM tracking enabled in form settings
• BUT: HubSpot captures UTMs only from landing page; needs supplemental script for multi-page journeys
• Use HubSpot’s "tracking code" + supplemental GTM script for full coverage
• UTMs auto-map to HubSpot’s built-in tracking fields (no manual CRM mapping needed)

Marketo Forms

• Hidden field implementation via JS
• Field mapping to Marketo program fields
• Custom Activity Type for "Form Submitted with UTM" enables deeper attribution reporting

Salesforce Web-to-Lead

• Manual setup required (no native UTM capture)
• Add hidden fields to web-to-lead form HTML
• Map to Salesforce custom Lead fields
• Critical: lead conversion mapping for Contact/Opportunity propagation

WordPress / Custom Forms

• Most flexibility but most setup required
• GTM scripts handle population universally
• Form plugin (Gravity Forms, Contact Form 7, WPForms) usually supports hidden fields
• Server-side webhook to CRM with UTM fields

Real Case: Rowlett B2B SaaS Recovers 18 Months of Attribution

In December 2025 we worked with a Rowlett-based B2B SaaS company (workflow software for distribution + logistics, ACV $24K–$120K, ~$11M ARR). Their attribution had been broken for 18 months without them realizing it:

• ~340 demo requests/month
• HubSpot lead source data showed: 67% "Direct," 18% "Organic Search," 8% "Paid Search," 4% "Referral," 3% "Social"
• The 67% "Direct" was suspicious — very few B2B SaaS prospects type URLs directly
• Marketing team had been making budget decisions assuming most leads came direct (so brand awareness wasn’t needed)
• Sales team consistently mentioned "they found us through [campaign description]" but data didn’t support it
• Discrepancy had persisted for 18 months

Implementation across 5 weeks:

1. Week 1: Audit. Ran 50 test submissions with various UTM combinations. Discovered: UTMs captured correctly only when form was on the immediate landing page (rare). 80% of form submissions on internal pages arrived with no UTM data — HubSpot defaulted to "Direct."
2. Week 2: Built GTM UTM capture script + cookie persistence (90-day window, 365-day for first-touch).
3. Week 3: Added hidden fields to all 14 HubSpot forms across the site. First-touch and last-touch UTMs separately captured.
4. Week 4: Created HubSpot custom properties for first-touch UTM fields. Configured set-once enforcement rule. Mapped lifecycle propagation through to deal records.
5. Week 5: Historical backfill attempt. Used HubSpot’s page-view history + GA4 source data to backfill source attribution for prior leads where possible. Recovered partial attribution for 60% of past 18 months of leads.

Implementation Checklist

• Audit current UTM capture rate — test submissions; see how many arrive with UTMs in CRM.
• GTM script on all pages — reads UTMs from URL, stores in first-party cookies.
• Both first-touch and last-touch fields — first-touch immutable, last-touch updates per visit.
• Hidden form fields on every form — populated from cookies at render time.
• CRM custom fields created — Lead, Contact, Opportunity objects.
• Lifecycle propagation tested — UTMs flow from Lead to Opportunity to closed-won.
• Salesforce lead conversion mapping — UTMs survive lead-to-opportunity transition.
• Historical backfill if possible — recover attribution for past leads using log data.

5 Common UTM Capture Mistakes

• 1. Only capturing UTMs on landing page. Misses 60-80% of multi-page-journey form fills. Cookie persistence required.
• 2. Only single first-touch OR last-touch. Need both. Different reporting needs different views.
• 3. First-touch overwriting on subsequent visits. Destroys long-term attribution. Set-once enforcement essential.
• 4. Salesforce lead conversion drops UTMs. Custom fields not in conversion mapping. Explicit mapping required.
• 5. Not auditing capture rate. Broken attribution invisible without explicit testing. Test quarterly.

For Dallas B2B companies, proper UTM capture infrastructure typically reveals 30–70% of leads were previously mis-attributed — with proportional impact on marketing budget decisions. The investment is small (2–4 weeks of GTM + CRM setup). Pair with the GCLID tracking in GCLID CRM integration and the HubSpot-Salesforce integration in CRM integration audit for complete attribution architecture.

Frequently Asked Questions