Website tracking

The tracking snippet records visits to your website with their source and campaign, and links them to the person once they send a form or place an order. You then see a funnel from visitors to buyers by source and campaign, and every contact's record shows the visits that led to their enquiry or order.

On WordPress, the WordPress plugin does all of this at once: it adds the snippet to every page, works with the CookieYes, Complianz and Cookiebot banners, and links form enquiries and WooCommerce orders to the visits that led to them. You add no code by hand.

Before you start

• Who can do it: owners and administrators add and change sites. Everyone in the company can read the reports.
• Plan: available when your plan includes Tracking and customer journey. The number of tracked sites is a plan limit.
• Consent: in many countries a visitor must agree before they are tracked. The snippet waits for consent unless you turn that off. Get legal advice before you do.
• Your privacy policy should mention the tracking before you switch it on.

Add your site

1. In the sidebar open Tracking.
2. Under Add a site, enter a Site name and the Domain, such as example.com. You can paste a whole address: only the domain is kept, without www..
3. Click Add a site. The site card shows a line under Add this line to your site header.
4. Copy that line and add it to the head section of every page of your site. On WordPress, the WordPress plugin adds it for you. Without it, use a plugin that inserts code into the header, or your theme's header settings, so you do not edit the theme's files.

The snippet works on the domain and all its subdomains, such as shop.example.com. Each subdomain keeps its own visitor ID, so one person who visits two of them counts as two visitors.

Connect your consent banner

A site you add here records nothing until the visitor agrees. A site the WordPress plugin adds for you waits for consent only when the plugin found CookieYes, Complianz or Cookiebot on your site. Otherwise it runs for all visitors; click Require consent on its card if your visitors must agree first. While consent is required, the card says Runs only after the visitor consents: call crmConsent() from your consent banner.

• When the visitor accepts, your banner calls crmConsent(). Tracking starts on that page and continues on later visits.
• When the visitor withdraws, call crmWithdraw(). It deletes the snippet's cookies from the browser.

Most consent plugins let you run a line of script when the visitor accepts a category such as statistics or marketing. Put crmConsent() there.

If your legal advice says consent is not needed, click Stop requiring consent. The card then says Runs for all visitors. Use only after legal advice. Require consent switches it back. Browsers keep the snippet for up to an hour, so a change can take that long to reach every visitor.

Tag your links with UTM

Sources and campaigns come from the utm_ values in the address the visitor lands on:

A link then looks like https://example.com/offer?utm_source=instagram&utm_medium=social&utm_campaign=autumn-sale. Use the same campaign names everywhere, because reports, store orders and campaign costs are matched by name. For Google Ads, the account setting in Google Ads tags every ad for you.

Test it

1. Open your site in a private window with ?utm_source=test&utm_campaign=crm-test added to the address.
2. Accept your consent banner.
3. In Tracking, the site card shows Last event: with the time, and Visitors goes up.
4. Send a website form from the same window, or place a WooCommerce order. The contact's record now shows Customer journey with First visit and the pages Viewed.
5. Under the site, click Check now: Rutba CRM opens your home page and says whether the tracking code is on it. The same test, for every connection, is on the Connection status page.

What it records

The snippet stores a random visitor ID in a first-party cookie named crm_vid, which lasts 180 days from the last visit. The consent is stored in crm_consent, which lasts 180 days from the day the visitor agreed.

Ad clicks

When a visitor arrives from an ad, the snippet also records which click brought them: Google's gclid, gbraid or wbraid, and Meta's fbclid, from the page address, plus Meta's own _fbc and _fbp cookies when your site has the Meta pixel. Like everything else, this happens only after consent where your site asks for it.

Each click is kept once. When the visitor sends a form or places an order, the click joins their contact and shows as Ad in their Customer journey. On the Advertising page, owners and administrators can then tell Google and Meta which clicks became sales. See Advertising.

How a visitor becomes a person

A visitor is anonymous until one of these happens:

Form plugins that send from your server, such as Elementor webhooks, cannot carry the visitor ID, so their enquiries are not linked to visits. The WordPress plugin is the exception: it reads the visitor ID while the visitor is still on the page.

The reports

Tracking shows the last 30, 90 or 365 days:

• Visitors, Page views, Known people and Buyers.
• Sources and campaigns: visitors, known people and buyers for each first source and campaign. A visitor with no utm_source is shown as Direct, even when they came from a search engine.
• Top pages by views.

Each contact's Customer journey lists up to 40 events, newest first: visits, ad clicks, enquiries, conversations, deals, quotes, orders, payments and campaign emails. Campaign returns, with cost and sales side by side, are under Reports.

Limits and behaviour

• Events are accepted only from pages on the site's domain or its subdomains.
• Each visitor address can send up to 240 events a minute, and each site accepts up to 600 new visitors a minute. Anything above is ignored without an error.
• Turn off on the site card stops recording; the snippet then does nothing. Turn on restarts it.
• If your plan stops including tracking, nothing is recorded until it does again.
• Erasing a contact under Data and privacy unlinks their visits.

Troubleshooting