Form Attribution

A lightweight, zero-dependency script that automatically captures marketing attribution data and injects it into forms as hidden fields.

Resource	Link/URL
CDN URL	`https://cdn.jsdelivr.net/npm/form-attribution@latest/dist/script.min.js`
Docs	https://form-attribution.flashbrew.digital/docs
GitHub	https://github.com/Flash-Brew-Digital/form-attribution

Basic Implementation

Add before the closing </body> tag:

<script src="https://cdn.jsdelivr.net/npm/form-attribution@latest/dist/script.min.js" defer></script>

The script automatically captures UTM parameters, stores them in sessionStorage, and injects hidden fields into all forms.

Configuration Options

Configure via data attributes on the script tag:

Attribute	Default	Description
`data-storage`	`sessionStorage`	`sessionStorage`, `localStorage`, or `cookie`
`data-field-prefix`	`""`	Prefix for hidden field names (e.g., `attr_`)
`data-extra-params`	`""`	Additional URL parameters to capture (comma-separated)
`data-exclude-forms`	`""`	CSS selector for forms to exclude
`data-click-ids`	`false`	Capture ad platform click IDs (gclid, fbclid, etc.)
`data-debug`	`false`	Enable debug panel overlay
`data-privacy`	`true`	Respect GPC/DNT privacy signals
`data-storage-key`	`form_attribution_data`	Custom storage key name

Cookie-specific options (when data-storage="cookie"):

Attribute	Default	Description
`data-cookie-domain`	`""`	Cookie domain (e.g., `.example.com`)
`data-cookie-path`	`/`	Cookie path
`data-cookie-expires`	`30`	Expiration in days
`data-cookie-samesite`	`lax`	`lax`, `strict`, or `none`

What Gets Captured

URL Parameters (default): utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id, ref

Metadata (automatic): landing_page, current_page, referrer_url, first_touch_timestamp

Click IDs (when data-click-ids="true"): gclid (Google), fbclid (Meta), msclkid (Microsoft), ttclid (TikTok), li_fat_id (LinkedIn), twclid (Twitter/X)

Common Configurations

With ad click ID tracking:

<script src="https://cdn.jsdelivr.net/npm/form-attribution@latest/dist/script.min.js"
  data-click-ids="true" defer></script>

Cross-subdomain tracking (cookies):

<script src="https://cdn.jsdelivr.net/npm/form-attribution@latest/dist/script.min.js"
  data-storage="cookie"
  data-cookie-domain=".example.com"
  data-cookie-expires="90"
  data-click-ids="true" defer></script>

CRM field prefix:

<script src="https://cdn.jsdelivr.net/npm/form-attribution@latest/dist/script.min.js"
  data-field-prefix="lead_"
  data-click-ids="true" defer></script>

Exclude forms (e.g., search, login):

<script src="https://cdn.jsdelivr.net/npm/form-attribution@latest/dist/script.min.js"
  data-exclude-forms=".no-track, #login-form, [data-no-attribution]" defer></script>

JavaScript API

The library exposes a global FormAttribution object:

FormAttribution.getData();              // Get all captured data
FormAttribution.getParam('utm_source'); // Get specific parameter
FormAttribution.getForms();             // Get tracked forms
FormAttribution.clear();                // Clear stored data
FormAttribution.refresh();              // Re-inject into forms

Privacy

Respects Global Privacy Control (GPC) and Do Not Track (DNT) by default. When detected, no data is captured. Override with data-privacy="false".

References (references/*)

Platform-Specific Patterns

For implementation patterns specific to Webflow, HubSpot, WordPress, Marketo, and certain other platforms, see references/platforms.md.

FAQ

For common questions about compatibility, privacy, performance, and customization, see references/faq.md.