How to capture UTM parameters in forms and keep them

UTM parameters are tags you add to the end of a link: ?utm_source=newsletter&utm_medium=email&utm_campaign=october-launch. The page they point to ignores them. Analytics tools such as Google Analytics read them when the page loads and attribute that session to the campaign you described.

Google's documentation lists nine parameters and says you should always use utm_source, utm_medium and utm_campaign. Values are case sensitive, so utm_source=Google and utm_source=google are two different sources in your reports. Our UTM builder at /tools/utm-builder assembles tagged links and handles URLs that already have a query string.

A hidden field is a form field the respondent never sees. Instead of being typed, its value is filled in from the page URL (or a default value) and stored alongside the visible answers. Named utm_source, it picks up whatever utm_source the link carried.

That puts the source on the lead record itself. To take a made-up example, analytics can report that the October email drove 40 submissions; only the form response can tell you that the one lead who became a large account came from that email. It also keeps working for visitors whose browsers block analytics scripts, because the tagged URL still reaches the form. It does record where someone came from, so mention it in your privacy notice.

UTMs live in the URL of the first page someone lands on. Three common situations drop them before the form ever sees them.

An ad lands on your pricing page with ?utm_campaign=spring. The visitor clicks to Features, then to Contact. The Contact page URL has no parameters, so a hidden field on that form reads nothing. This is the most common reason UTM hidden fields come back empty.

An embedded form runs at its own URL inside a frame. Unless the embed code copies the host page's query string onto the frame's address, the form sees none of it. Check what your builder's embed code does. Zunoform's embed script copies the host page's query string onto the frame, so a visitor who lands on the page that holds the form with ?utm_source=google is captured without extra work (add data-forward-params="false" to switch that off, or data-params to set values of your own). A plain iframe snippet copies nothing, so there you add the parameters to the iframe's src yourself, as in the snippet below.

Most shorteners and redirects keep the query string, but some site redirects (http to https, trailing slashes, a language switch) rebuild the URL without it. Click your tagged link and look at the address bar where you end up.

Once the UTMs are on the response, they should travel with it. In most builders hidden fields are included wherever answers go: the spreadsheet row, the webhook payload, the CRM contact. Map utm_source to your CRM's lead source property and utm_campaign to a campaign property, rather than dumping them into a notes field nobody filters on.

Be precise about what your tool actually sends. In Zunoform, hidden fields appear in the response view, the per-form CSV export and the Business plan's REST API, and they travel with each delivery: Google Sheets and Excel rows get one extra column per hidden field (after the answer, location and user-agent columns), webhook, Zapier and workflow payloads carry them in a hidden object (hidden.utm_source), and Airtable fills columns with the same name. HubSpot and Mailchimp do not receive them yet, so to get UTMs into those, route the lead through Zapier or a webhook.

However you move the data, clean the values on the way in: lowercase them and map known variants ("fb", "facebook.com") to one name, or your source report will have six rows for Facebook.

GA4 already attributes each session to its UTM source, so what it needs from you is a reliable conversion event. Its enhanced measurement can send form_start and form_submit automatically for forms on your own pages, though Google notes the parameters need custom dimensions before they show in reports. The recommended event for a lead is generate_lead, which Google describes as firing when a user submits a form; mark it as a key event.

Embedded forms are the catch. GA's tag on your page cannot see clicks inside an iframe served from another domain, so form_submit will not fire for it. The dependable pattern is to redirect respondents after submitting to a thank-you page on your own site and fire generate_lead there. Zunoform can redirect after submit, and the redirect URL can carry answers, such as the plan someone picked, so the thank-you page can send them as event parameters. Test this on an embedded form: its redirect loads inside the frame, where browsers may limit analytics cookies, so it is most reliable when the form is opened as a direct link.

Keep personal data out of that URL. Google's guidance is that URL paths and parameters sent to Analytics must be free of PII, so pass a plan name or budget band, never an email or phone number.

Hidden fields are on every Zunoform plan, including Free: you name the parameters, set optional defaults, and the values are saved with each response, shown in the response detail and exported as CSV columns. Redirect after submit is on every plan too, and redirect URLs can carry answers to a thank-you page. If you switch a form to anonymous mode with hidden fields on, the builder warns you that URL values can still identify people.

Hidden field values go out with every Google Sheets, Excel, Zapier and webhook delivery, and the embed script forwards your page's query string to the form. The limits are real, though. The native HubSpot and Mailchimp integrations do not map hidden fields to contact properties, and there is no built-in first-touch storage, so the snippet above is your job. If you need UTMs written straight onto CRM contact properties without a Zapier or webhook step, a tool whose native CRM integration maps hidden fields, or a dedicated attribution plugin, is a better fit today.