Cherry Seed

How does server-side tracking protect UTMs?

server-side tracking utm parameters attribution first-party data redirect stripping campaign tagging

Quick Answer

Server-side tracking captures UTM parameters the instant a request reaches your web server, before browsers, redirects, or privacy extensions can strip them. While client-side JavaScript fires after page load and after potential parameter loss, server-side code reads the raw inbound URL at the PHP or Node.js layer, stores attribution in a first-party session or database, then forwards clean data to GA4, Meta CAPI, and BigQuery regardless of what happens in the browser afterward. Google Analytics documentation confirms server-side collection bypasses client-side interference entirely. The result: attribution survives even when browsers strip every utm_ parameter from the address bar.

Full Answer

The core mechanic is timing. When a visitor clicks a campaign link containing utm_source, utm_medium, and utm_campaign parameters, those values exist in the URL for a brief window. Client-side tracking relies on JavaScript executing inside the browser to read those values, but by the time the script fires, several things may have already intervened: a redirect may have dropped the query string, Safari ITP may have stripped the click identifier, an ad blocker may have prevented the tag from loading at all, or a consent banner may have delayed execution past the critical moment.

Server-side tracking sidesteps every one of those failure points. The web server processes the inbound request before the browser renders anything. At that layer, the full URL including every UTM parameter is available as a raw HTTP variable. A server-side pipeline captures those values, hashes them into a first-party session record, and stores attribution data in a database or warehouse like BigQuery. Once stored, no browser behaviour can retroactively erase what the server already recorded.

This architecture also solves the redirect-chain problem. HTTP-to-HTTPS redirects, trailing-slash normalisation, and marketing platform redirects can each silently drop query parameters if misconfigured. Server-side capture happens on the very first request, before any redirect executes. The attribution data is already safe by the time the redirect fires. For WooCommerce stores running paid campaigns, this means the connection between ad click and purchase survives the full journey from click to checkout, even across sessions and devices.

Sources

Programmatic Access

GET https://seresa.io/wp-json/cherry-tree-by-seresa/v1/seeds/772

Cite This Answer

Cherry Tree by Seresa - https://seresa.io/seed/utm-attribution/protect-utm-server-side-capture