Installing Sourcream

Sourcream records where every lead came from and delivers it into your CRM. Source to CRM. These guides cover the install for each platform and each destination.

Start here

1. In Sourcream, open Sites, add your site (one primary domain; its subdomains are included, see what counts towards your plan) and open its Install tab.

2. Put the script tag from the Install tab in the <head> of every page:

   <script src="https://cdn.sourcream.ai/t/YOUR_SITE_KEY.js" async></script>
   

3. Submit a form on your live site with ?utm_source=test&utm_medium=test&utm_campaign=install on the URL, then check Leads. The Install tab also shows a live status once the script has been seen.

4. Connect a CRM under Integrations, or send leads anywhere with a signed webhook.

Guides

How a lead gets its source

The script runs on every page view and classifies the visit. The first match wins:

1. utm_source: source is utm_source, medium is utm_medium (or (none)), campaign is utm_campaign (or (none)). Term, content and utm_id are kept too.

2. gclid, gbraid or wbraid: google / cpc / the utm_campaign or google_ads. dclid: google / display / google_display.

3. msclkid: bing / cpc / the utm_campaign or bing_ads.

4. fbclid: facebook / cpc / the utm_campaign or facebook_ads. The medium is a site setting (cpc, paid_social or social), because Meta adds fbclid to organic link clicks too.

5. Other ad click ids: ttclid (tiktok), li_fat_id (linkedin), twclid (twitter), epik (pinterest), ScCid (snapchat), each cpc.

   Rules 2 to 5 use the link's utm_campaign as the campaign when it has one, so ?fbclid=...&utm_campaign=retarget is facebook / cpc / retarget. Other utm_* values with no utm_source and no click id give source (not set).

6. No referrer, a referrer on your own domains, or a payment or sign in page (Stripe, PayPal, Google and Microsoft sign in and similar): (direct) / (none).

7. Any other referrer: AI assistants get medium ai (ChatGPT, Perplexity, Claude, Gemini, Copilot and others), webmail gets email, social platforms get social, messaging apps get messaging, search engines get organic with the engine name as source (google, bing, duckduckgo), and everything else is referral with the host as source.

Click ids are captured on every visit whichever rule classified it. When the URL has no gclid or fbclid, Sourcream reads them from the _gcl_aw and _fbc cookies set by Google and Meta tags.

First touch is written once and never changed. Last touch is the latest visit that was not direct: a direct return visit never overwrites it. Both last 180 days. A new session starts after 30 minutes without activity.

On plans with AI source enrichment (Business and above), Sourcream also tidies broken UTMs (Facebook, fb and facebook-ads all become facebook) and categorises referrers it has not seen before. Only the referring host name is analysed, never page addresses or personal information.

Field names

Every form gets these values (the core set, on every plan):

Business, Pro and Agency plans can switch a site to the extended set, which adds: first_term, first_content, first_channel, first_landing_page, first_referrer, first_timestamp, last_term, last_content, last_channel, last_landing_page, last_referrer, last_timestamp, gclid, gbraid, wbraid, msclkid, fbclid, ttclid, li_fat_id and touch_count. Timestamps are ISO 8601 in UTC. Channels (for example Paid Search, Organic Social, AI Assistants) are worked out on our servers, so they are always complete in CRM deliveries and webhooks but can be blank in hidden form fields.

You can rename any field per site under Sites, Settings, Field names (letters, digits, _, -, [, ] and ., up to 64 characters), for example to match a CRM's own field ids.

What counts towards your plan

One tracked event is one lead: a form submission Sourcream captured. Page views and visits are never counted. When you reach 80% and 100% of your monthly allowance we email the account owners. Tracking never stops mid month.

Your plan also sets a number of domains, shared by an agency account and all its client accounts:

• Each site uses one domain, its primary domain. Two sites on subdomains of the same domain (shop.acme.com and blog.acme.com) use two.
• A site's Own domains are free when they are subdomains of its domain (book.acme.com.au on an acme.com.au site) or hosts on a shared platform (acme.webflow.io, acme.squarespace.com, acme.pages.dev, acme.netlify.app, acme.vercel.app and similar staging and builder addresses).
• Any other domain among a site's own domains, with its subdomains, uses one more domain: acme.com on an acme.com.au site, or a separate landing page domain. It counts once however many sites list it, and not at all when one of your sites already has it (or a subdomain of it) as its primary domain.

A new site past the limit is refused, and so is saving own domains that take the account past it (the message names the domains that count). Saving a site that does not add domains always works, so after a downgrade you can still edit sites and remove domains.

Honest limits

• First-party mode reduces blocking. It is not unblockable, and no tracker is.
• Your site key is public, so anyone can fill your site's hourly caps on new visitors and lead beacons, whatever proxy you use. Until the next UTC hour your site's new visitors and lead beacons then get 429. Leads sent to the webhook intake have a cap of their own and keep arriving, which makes the intake the robust way to capture leads (hourly caps).
• Sourcream uses first-party cookies only, never third-party cookies. Remembering a first visit for 180 days needs something stored in the browser, so "no cookies" is not possible for multi visit attribution.
• Dark social (WhatsApp, Slack and Telegram desktop apps), desktop email clients and redirects that drop the query string all arrive without a referrer, so they look direct. Tag links you share with UTMs.
• Google organic never passes the search keyword. Paid search without gclid or UTMs looks like organic.
• When a site captures email addresses on submit (the default), Sourcream processes personal information under the Australian Privacy Principles until it is redacted after your retention period. Matching CRM records by visitor ID instead avoids sending any.

Questions: [email protected]