Someone clicks your ad. Three pages later, they send a form or place an order. By then the campaign is usually gone, and the lead looks like it came from nowhere.

ClickTrail keeps what the visitor arrived with: the UTMs, the ad click ID, the referrer. It carries that context to the form entry or the WooCommerce order, and to a Calendly booking. You open the record and see where it came from.

ClickTrail records what arrived. It does not decide what caused the sale.

Start here

Pick the path that matches your site.

WooCommerce store: turn on Capture and WooCommerce. Orders carry the campaign. Add storefront events later if you want funnel signals.
Lead forms: turn on Capture and Forms. Fluent Forms gets hidden fields on its own; Contact Form 7 fills the ct_* tags you reference ([hidden ct_gclid] in the form or [ct_gclid] in the mail). Gravity Forms, WPForms, Formidable Forms, Forminator and MetForm fill the ct_* fields you add (WPForms Lite has no Hidden field: use a Single Line Text field with the CSS class ct_<key> and hide it with CSS; Formidable Forms: a Hidden field whose Field Key is ct_<key>; Forminator: a Hidden field with the custom CSS class ct_<key>; in MetForm, name a hidden input ct_<key>).
GTM or server-side GTM: turn on Capture, Events, and Delivery. Events go to the dataLayer, and ClickTrail can send canonical JSON to an endpoint you set.

Then place one test order or send one test form, and look at what was stored. The use-case guide and tutorials walk through each path.

What it does

ClickTrail only acts on the paths you turn on and set up in its settings. That is what “configured” means everywhere in this readme.

Capture: first-touch and last-touch UTMs, ad click IDs, and the referrer, with organic, social, and referral fallback when there are no UTMs. When a visitor comes back through a new ad, the newest click is the one that travels. Context lives in first-party storage, falls back to sessionStorage when cookies are blocked, and your own admin browsing stays out of it.
WooCommerce: attribution saved on the order before an off-site payment redirect (classic and block checkout), with returns from payment hosts such as PayPal or Stripe never overwriting the stored touch, an enriched purchase event on the thank-you page, optional storefront events (view_item, view_item_list, view_cart, add_to_cart, remove_from_cart, begin_checkout), and optional order-status milestones. Order metadata has export, erase, retention, and uninstall handling.
Easy Digital Downloads (3.0+): attribution saved on the order when it is created, which is before an off-site payment such as Stripe or PayPal, and one purchase pushed from the order confirmation receipt with event_id purchase_edd_<order ID>. Reloading the receipt does not push it again. Nothing is stored or pushed without the consent your settings require. Order metadata has export, erase, retention, and uninstall handling. Runtime-verified in a disposable stack with the Store gateway only; Stripe and PayPal themselves are not.
Ultimate Member: a registration through an Ultimate Member form stores the visitor’s attribution on the new user (_clicutcl_* user meta, only with marketing consent) and sends one sign_up event. Users registered from wp-admin get nothing. The meta has export, erase, retention and uninstall handling. Source-present; runtime-unverified beyond one pinned test run.
Forms: Fluent Forms gets hidden fields automatically; Contact Form 7 fills the ct_* tags you reference ([hidden ct_gclid] or [ct_gclid] in the mail). Gravity Forms, WPForms, Formidable Forms and Forminator fill the ct_* fields you add; Gravity Forms also gets a channel label, nine {clicutcl_*} merge tags, and a per-form switch. Elementor Forms (Pro) and Ninja Forms keep attribution with the submission record. The server renders those fields empty so a page cache never serves one visitor’s attribution to another (the clicutcl_render_server_attribution_values filter opts back in on sites without a cache); the browser fills them after load, the submit-time cookie corrects them, and keys the cookie lacks are blanked rather than kept. Cached form pages need no exclusion. A client-side fallback covers cached pages and forms that load late, and WhatsApp links can carry the context too.
WhatsApp: a click on a wa.me, api.whatsapp.com or whatsapp:// link pushes one contact_whatsapp_start event (with consent). With Append attribution to message on (off by default) the pre-filled text ends with a short Ref: CT-XXXXXXXX code instead of the attribution payload; an administrator pastes it into Diagnostics to see the stored first/last touch and click ID.
Bookings and your other domains: links to domains you approve carry the campaign, with a signed token between your own sites. Calendly booking links hold the newest click and the visitor’s consent decision, and the signed Calendly webhook records the booking as book_appointment with its UTMs. Booking or form iframes your own script loads can carry the campaign too, through window.ClickTrail.decorateEmbedUrl(), for hosts you list.
Events and delivery: browser events to the dataLayer, a REST intake, webhooks from Calendly, HubSpot, and Typeform, lifecycle updates, and one-time WordPress events such as login, sign_up, and comment_submit. Optional server-side delivery adds a retry queue and diagnostics.

Consent and privacy

When consent is required, nothing is stored until the visitor agrees. ClickTrail listens to its own banner, Cookiebot, OneTrust, Complianz, GTM, or a custom source, or detects the source for you. ClickTrail follows Cookiebot and Complianz decisions, including changes the visitor makes on the page. On withdrawal, ClickTrail clears its storage and removes the parameters it added to links. Queued deliveries check current consent again right before they are sent, and the consent decision stays in sync across tabs. Consent behavior can be strict, relaxed, or geo-based. ClickTrail helps you implement consent; compliance still depends on your legal requirements and your settings.

What it does not do

It does not prove which click caused a sale, and it does not decide which channel deserves the revenue.
It does not resolve one person’s identity across devices.
It is not an attribution dashboard, a hosted server-side GTM platform, a lead manager, or an ad optimizer. It works alongside GA4 and GTM. For call tracking, lead scoring, or ad-spend optimization, pair it with a specialist tool.
It does not install ad pixels. The Meta Pixel, Google tag, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag, and Reddit Pixel stay yours, usually through GTM.
Server-side delivery sends JSON to the endpoint you configure. The adapters named after Meta, Google Ads / GA4, LinkedIn, Pinterest, and TikTok exist in the code, but we have not verified that any provider accepts them end to end. Reddit is a relay-only destination.
We have not yet verified a live Calendly booking round trip.

Having code for an integration is not proof that it works in production. Current status lives in the integration reference and the machine-readable ledger. The release-phasing plan shows what gets checked next.

Supported click IDs

Google: gclid, wbraid, gbraid
Meta: fbclid
TikTok: ttclid
Microsoft: msclkid
X / Twitter: twclid
LinkedIn: li_fat_id
Snapchat: sccid, snap_cid
Pinterest: epik, pin_cid
Reddit: rdt_cid
Mailchimp: mc_cid, mc_eid
Display & Video 360: dclid

Integrations

Forms: Contact Form 7, Elementor Forms (Pro), Fluent Forms, Formidable Forms, Forminator, Gravity Forms, MetForm, Ninja Forms, SureForms, WPForms
Commerce: WooCommerce, Easy Digital Downloads (3.0+)
Registration: Ultimate Member
Consent sources: ClickTrail banner, Cookiebot, OneTrust, Complianz, GTM, custom
Webhooks: Calendly, HubSpot, Typeform
Server-side adapter keys: generic collector, sGTM, Meta CAPI, Google Ads / GA4, LinkedIn CAPI, Pinterest Conversions API, TikTok Events API (status above)
Extra fields captured: utm_id, utm_source_platform, utm_creative_format, utm_marketing_tactic, fbc, fbp, _ttp, li_gc, ga_client_id, ga_session_id
Caching and minification: on every site, the four ClickTrail script tags (clicutcl-consent-bridge-js, clicutcl-attribution-js, clicutcl-consent-js, clicutcl-events-js) carry nowprocket data-no-optimize="1" data-no-defer="1" data-noptimize="1" data-cfasync="false": nowprocket (WP Rocket Delay JS), data-no-optimize="1" and data-no-defer="1" (LiteSpeed Cache), data-noptimize="1" (Autoptimize), data-cfasync="false" (Cloudflare Rocket Loader). The same scripts are registered on the exclusion filters of WP Rocket (rocket_delay_js_exclusions, rocket_exclude_defer_js, rocket_exclude_js), LiteSpeed Cache (litespeed_optimize_js_excludes, litespeed_optm_js_defer_exc, litespeed_optm_gm_js_exc), Autoptimize (autoptimize_filter_js_exclude), Perfmatters (perfmatters_delay_js_exclusions, perfmatters_defer_js_exclusions, perfmatters_minify_js_exclusions), SiteGround Speed Optimizer (sgo_js_minify_exclude, sgo_javascript_combine_exclude, sgo_js_async_exclude), and FlyingPress JS minification (flying_press_exclude_from_minify:js); NitroPack adds data-nitropack-exclude="true" and nitropack_js_url_exclude when active. The inline consent-default snippet carries nowprocket data-no-defer="1". To check: view the page source, confirm every clicutcl-*.js tag carries the attributes, and confirm window.ClickTrail is defined before submitting a form. Delay-JS features run scripts on the first interaction (WP Rocket lists keydown, mousemove, touchstart, scroll, click, input, onsubmit), so a keyboard-only submit still runs them, too late for the landing touch. FlyingPress documents no attribute and no delay or defer filter, only the minification filter above: add clicutcl and clicktrail-consent-mode to its exclusion field. Source-present / runtime-unverified.

ClickTrail – UTM, Click ID & Ad Tracking (with Consent)