Skip to content
TraceLead
Start free trial

Send UTM parameters to Zapier, Make or your own endpoint, lead by lead

The moment TraceLead records a lead, a signed webhook posts its attribution to Zapier, Make or your own endpoint: channel, source, medium, UTM campaign and landing page. No contact details, no form answers, no visitor ids.

Start 14-day free trial Read the webhooks guide

No card needed. No lead caps on any plan.

The attribution each webhook carries Sample data

Added by TraceLead's hidden fields. The name and email stay in your form.

Channel
Paid search
Source / medium
google / cpc
Campaign
brand-uk
Click ID
gclid
Arrived from

Why UTM parameters rarely reach Zapier

A form tool's Zapier trigger sends what the form holds. Unless something filled hidden fields with the campaign, the Zap gets the name and message and no source.

TraceLead can send the source by itself. When a visitor who accepted cookies sends a form with a mapped hidden field, the snippet reports the lead with its first-touch attribution, and TraceLead posts that to every webhook on the site.

  • Up to 3 webhooks per site, each with its own signing secret, shown once.
  • https:// only. Addresses that resolve to private, loopback or link-local networks, and URLs with credentials, are refused.
  • Signed with HMAC-SHA256 over the timestamp and body, in X-TraceLead-Signature.
  • Three retries with back-off, and the last 20 attempts per webhook on the site page with status code and timing.
  • Only owners and admins can add, test or remove a webhook.

How to send lead source data to Zapier or Make

Four steps. The webhook needs the TraceLead tag on your site and lead collection left on in the site's collection settings.

The full webhooks guide

  1. Get a webhook address

    In Zapier, start a Zap with Webhooks by Zapier → Catch Hook. In Make, add a Custom webhook. Or use your own https:// endpoint.

  2. Add it in TraceLead

    On your site's page, open Lead webhooks, paste the URL and choose Add webhook. Copy the signing secret now: it is shown once.

  3. Send a test event

    Send test event posts a sample lead with "test": true and shows the result in the delivery log, so Zapier or Make can learn the fields before a real lead arrives.

  4. Verify the signature at your endpoint

    Recompute the signature and reject anything older than five minutes. In PHP:

    $expected = 'sha256='.hash_hmac('sha256', $timestamp.'.'.$body, $secret);

if (! hash_equals($expected, $signature) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit;
}

    Answer with any 2xx within 5 seconds. Redirects are not followed.

What each lead webhook contains

A POST with Content-Type: application/json and exactly these keys, in this order. Empty values are null.

Never sent: names, email addresses, phone numbers, form answers, IP addresses, user agents, full referrer URLs, click id values, and the visitor and session ids TraceLead uses for counting.

Key Holds
event Always lead.created
event_id Unique per lead, so a repeated delivery can be ignored (0 on a test event)
site_public_id The public id of the site the lead came from
occurred_at When the form was sent, UTC
form_id The form's id or name attribute
page_path The path of the page the form was sent from
channel The first-touch channel, such as paid_search
source The first-touch source, such as google
medium The first-touch medium, such as cpc
utm_campaign The campaign from the UTM tags
utm_term The keyword, when your ads tag it
utm_content The ad or link variant
utm_id The campaign id from the UTM tags
click_id_type Which click id was present (gclid, msclkid…), never its value
referrer_host The site that sent the first visit, hostname only
landing_page The first page seen, sensitive parameters removed
first_touch_at When the first visit happened, UTC
test true only for "Send test event"

Headers: X-TraceLead-Event: lead.created, X-TraceLead-Timestamp (Unix seconds) and X-TraceLead-Signature: sha256=….

Attribution without personal data. No names, emails, form values, IP addresses or user agents. Ever.

No privacy workarounds. Nothing before consent, no fingerprinting, no ad-blocker bypass, no cross-site identity.

Made in the UK. GBP pricing, UK consent rules in mind, and a person who answers email.

Questions, answered

Anything else? Email us and a person replies.

How do I send UTM parameters to Zapier?

Create a Zap with "Webhooks by Zapier" and the Catch Hook trigger, copy its URL, and add it under Lead webhooks on your site's page in TraceLead. Each new lead then arrives in Zapier with its channel, source, medium, UTM campaign, term and content, landing page and first-touch time, ready to map into a CRM, sheet or Slack message.

Can I send lead source data to Make.com?

Yes. Make's custom webhook accepts the request as it is: paste the webhook address from Make into TraceLead and use "Send test event" so Make can learn the structure. The same works for n8n, a Slack workflow or your own endpoint.

What does a lead source webhook contain?

The attribution of one lead: the channel, source and medium of the first visit, the UTM campaign, term, content and id, which kind of click id was present, the referring host, the landing page, the page and form it was sent from, and the times. It never contains the visitor's answers, contact details or any visitor or session id.

How do I verify the webhook signature?

Each request carries X-TraceLead-Timestamp and X-TraceLead-Signature. Compute the HMAC-SHA256 of the timestamp, a dot and the raw body with your signing secret, compare it with the signature in constant time, and reject requests more than five minutes old. The guide has PHP and Node.js examples.

What happens if my endpoint is down?

A failed delivery is retried three times, after about 10 seconds, 1 minute and 5 minutes. After 50 failed attempts in a row the webhook is switched off and the organisation's owners get an email; switch it back on from the site page once the endpoint works.

Does the webhook include the gclid?

No. It says which click id was present, such as gclid, but not its value. If you need the gclid itself, for an offline conversion import, add a tl_gclid hidden field to the form so it travels with the enquiry.

More features

Every new lead's source, posted where you work.

Install the tag, keep at least one mapped hidden field in your form, add the webhook URL on the site page and press Send test event.

Start 14-day free trial Read the webhooks guide

No card needed. Cancel any time.

The whole install v1.4.0 
Site page → Lead webhooks → Add webhook
  https://hooks.zapier.com/hooks/catch/…

POST, Content-Type: application/json
X-TraceLead-Event: lead.created
X-TraceLead-Timestamp: 1760262067
X-TraceLead-Signature: sha256=<hex HMAC-SHA256 of "{timestamp}.{body}">