Hidden field

Every piece of attribution you have at the lead level arrives through this mechanism. If the hidden field is empty, the GCLID is gone, the campaign is unknown, and no amount of downstream analysis recovers it — the click identifier existed for one page load and was not written down.

The same mechanism has a second, opposite job. A honeypot is a hidden field used defensively: one nobody should fill, whose population is evidence of automation. Attribution fields are hidden fields used descriptively. An automated filler that fills everything it finds fills both, which is why the honeypot works at all — and why a filler smart enough to skip your honeypot is also reading your attribution.

• Capture at landing, persist in a first-party cookie or server session, and write into the field at render. Not at submit.
• Carry the whole set: click ids, UTM parameters, landing page path, referrer, and a session id you can join on later.
• Test them on the paths that break: cached pages served by a CDN, forms embedded in an iframe on another domain, and any journey that crosses domains.
• Alert when a field that is normally populated goes empty. A silently broken attribution field looks exactly like a change in traffic mix, and it can run for a quarter.

The single most common attribution bug in lead generation. The script reads window.location.search when the form is submitted rather than when the visitor landed.

Your best-behaved buyer clicks the ad, reads three pages, checks the pricing, and then submits from a URL with no parameters on it. The tracking parameters were on the first page. The submission is recorded as direct, the campaign gets no credit, and the report concludes that direct traffic converts unusually well.