TL;DR
  • Lead source attribution assigns each lead, and ideally each customer, to the marketing that produced it.
  • Analytics attributes sessions; attribution attributes people. One informs a traffic report; the other informs a budget.
  • Last touch lies, because the last touch is so often Direct. SparkToro logged 100% of visits from TikTok, Slack, Discord, WhatsApp, and Mastodon, and 75% of Facebook Messenger visits, as Direct (SparkToro, 2023).
  • Your CRM cannot fix it. HubSpot reports default to Latest Source, and Salesforce has no automatic web detection at all.
  • Every jump on the maturity ladder depends on one move: capturing the source against the lead, at the moment it is created.

What lead source attribution means

Lead source attribution, often shortened to lead attribution, is the practice of assigning each lead, and ideally each customer, to the marketing that produced it. Done properly it tells you not just that a form was filled in, but which channel, source, and page brought the person who became a paying customer.

It is worth separating from web-analytics attribution, because they answer different questions. Analytics attributes sessions: it groups anonymous traffic so you can see patterns across thousands of visits. Lead source attribution attributes people: it connects a named lead to the marketing behind them and follows that link into whether they bought. Analytics tells you Tuesday had more visitors from paid search. Attribution tells you the $30,000 client came from the Local Services Sydney ad. One informs a traffic report; the other informs a budget.

Abstract illustration: several distinct coloured channels flowing in parallel.

Why “last touch” lies

Most default attribution credits the last channel that touched the visitor before they converted. It is the easiest to compute and the most misleading, because the last touch is so often “Direct”, and Direct is usually a lie of omission.

Direct is what gets recorded when the system cannot see where someone came from. And systems cannot see far more often than they admit. In a controlled experiment, SparkToro drove real visits across eleven platforms using uniquely tagged links, so the true source was always known. Analytics still logged 100% of the visits from TikTok, Slack, Discord, WhatsApp, and Mastodon, and 75% of Facebook Messenger visits, as Direct (SparkToro, 2023). Those visitors did not type your URL from memory. The source was simply invisible, so it was filed under Direct, and last-touch attribution then handed the credit to nothing.

Abstract illustration: records spilling out of a drawer, filed under the wrong label.

The people who build the browsers document the technical reasons. Mozilla’s MDN documentation on Referrer-Policy describes when the referrer is trimmed or dropped on cross-site clicks. Apple’s own WebKit documentation explains that Safari’s tracking prevention restricts cross-site state, and Intelligent Tracking Prevention 2.3 shortened how long client-side values persist. And Google’s analytics documentation notes that missing campaign parameters show up as (not set). Build attribution on the last touch and you are building on the one signal most likely to have already evaporated.

First touch versus the full journey

If last touch over-credits Direct, first touch over-credits whatever was captured on arrival and ignores everything after. The honest picture is the journey: the source that first brought someone, the pages they read while deciding, and the form they finally filled. Seeing that whole path for a single lead, the source, the ordered pages, and the form, is its own view: the full journey to every lead.

Last touch

Credits the final source before conversion. Cheap to compute, and routinely wrong, because that final source is so often an unseen Direct.

First touch

Credits the source that first brought the visitor. Closer to the truth for lead source, but blind to the sources that nurtured the decision.

Full journey

Keeps the real first source plus the path through your site. The version that lets you fund what starts customers and what closes them.

For lead source specifically, first-touch attribution captured accurately is the workhorse: it answers “which marketing brought this customer in.” The journey adds the context that makes the reply, and the budget call, smarter.

The trap is arguing about attribution models while the underlying data is broken. A perfectly weighted multi-touch model built on sources that are half “Direct” is a precise calculation on garbage. Before you choose between first touch, last touch, or anything fancier (the attribution models explained), make sure the source is captured accurately in the first place. The model is a rounding decision; the capture is the data. Get the capture right and even a simple first-touch view beats an elaborate model fed on guesses. The progression from no tracking to a full multi-touch view is worth seeing as stages, which is what the attribution maturity model below lays out.

How attribution breaks in your CRM

The instinct is to trust the lead source field in the CRM. The problem is structural, not a setting you forgot to flip.

HubSpot keeps an Original Source and a Latest Source, and many reports default to Latest. So a lead who first arrived from a Google ad, then returned weeks later by typing the URL, is recorded as Direct, and the source that actually produced them is overwritten. The first-touch value exists but the report you look at quietly prefers the last one. (We cover the fix in detail on tracking lead source in HubSpot.)

Salesforce treats Lead Source as a manual picklist your admin defines, with no automatic web detection: no cookies, no UTM parsing, no referrer analysis. With Web-to-Lead forms the field stays blank unless a developer hard-codes a value, so in practice it is empty or set to one generic “Web” for every online lead. The CRM is not lying; it was never built to see the source in the first place.

The pattern is the same across tools: when they cannot see where a visitor came from, they fall back to Direct, Web, or blank. That is why accurate attribution has to capture the source independently, at the moment of submission, and write it back, rather than trust a field that structurally cannot know.

The tell is when your CRM’s source breakdown does not match reality you can check. You know you spent $4,000 on Google Ads last month and the account reported plenty of clicks, but the CRM shows three leads from “Paid Search” and forty from “Direct.” Those forty did not teleport in. They are paid clicks whose source was lost somewhere between the ad and the form, then filed under the catch-all. Until the capture is fixed, no amount of report configuration recovers them, because the data was never written down in the first place.

Volume is the easy number, value is the one that pays

For a business that runs on enquiries, the form is the cash register. You spend across several channels at once, Google Ads, SEO, referrals, a directory listing, the occasional sponsorship, and enquiries come back. Counting them feels like measurement. It is not, or not the kind that helps.

One channel can flood your form with enquiries that never convert: tyre-kickers, wrong-fit cases, people price-shopping. Another sends a handful that almost all become clients. Judge them on volume and you back the first and starve the second, which is exactly backwards. The channel that looks busiest in your inbox is often not the one paying your bills.

You do not have to fix everything at once. Pick the form that produces most of your enquiries, make sure every submission records where it came from, then look back over the last quarter and sort your clients by source rather than your enquiries by source. The gap between those two lists is usually the whole story. The enquiry you cannot trace is the marketing you cannot repeat.

The attribution maturity model: five stages

Attribution is usually treated as a yes-or-no thing: either you track your marketing or you don’t. In practice it is a progression. Each stage captures a bit more of the journey, and each one answers a question that could not be answered at the stage below. Here is the ladder.

1

Website analytics “how much traffic?”

You have Google Analytics or similar. You can see sessions, channels, and which pages get visited. What you cannot see is which of those visits turned into a lead, let alone a customer. Analytics counts behaviour in aggregate; it does not know who filled in your form.

2

UTM tagging “which source?”

You tag your links so paid and email traffic arrives labelled instead of lumped into “direct.” Now your analytics can group visits by source. The limit: the labels live in the URL and your analytics, not against the individual lead, so you still cannot point at a person and say where they came from. The UTM tracking guide covers this stage.

3

CRM source capture “which lead from where?”

The source is captured at form submission and written onto the lead record in your CRM, so each contact carries its real origin instead of “Web.” This is the stage most businesses skip, and it is the one that ends the guessing, because attribution stops being an analytics report and becomes a field on the lead. That captured first touch is the workhorse here; see where first-touch fits.

4

Revenue attribution “which marketing pays?”

Because the source now lives on the lead, it follows that lead through the pipeline to closed-won or closed-lost. You can finally answer the only question that funds budgets: which sources produce customers, not just leads. For most businesses, this is the stage worth reaching.

5

Multi-touch “which combination?”

Credit is shared across the several interactions in a longer journey, so you can see how channels assist each other rather than only the first or last click. This pays off for businesses with long, many-step buying cycles. Reach for it before Stage 4 is solid and you mostly add complexity ahead of answers.

StageQuestion it answersWhat it gives you
1. Website analytics“how much traffic?”sessions, channels, and which pages get visited
2. UTM tagging“which source?”your analytics can group visits by source
3. CRM source capture“which lead from where?”each contact carries its real origin instead of “Web”
4. Revenue attribution“which marketing pays?”which sources produce customers, not just leads
5. Multi-touch“which combination?”how channels assist each other rather than only the first or last click

Where most businesses actually sit

The common pattern is a jump from Stage 2 to a stall: links are tagged, analytics looks busy, and yet the CRM still says “Web” on every lead. That is Stage 2 dressed up as Stage 4. The tell is simple. Open your CRM, look at the lead source field on your last twenty leads, and count how many name an actual source. If the answer is “none, they all say Web or Direct,” you are at Stage 2, whatever the analytics dashboard implies. The why behind that gap is the capture problem described above.

The one move that changes your stage

Every jump on this ladder depends on capturing the source against the lead, at the moment it is created. That single step is what turns analytics into attribution. It is the whole job of lead source tracking, and Lead Source does it with one line of code on any form, writing the real source into the CRM you already use.

What good attribution looks like

Good lead attribution is source-level, customer-weighted, and captured first-party at submission. Source-level, because “Paid search” is not a budget decision; “Local Services Sydney” is. Customer-weighted, because a channel that sends ten cheap leads and no customers is worse than one that sends two leads and a client. And captured first-party at submission, because that is the only method that survives the referrer stripping, ITP, and UTM loss above.

Accurate attribution matters more, not less, in a market where a lot of ad spend is wasted on its own terms. System1’s research on advertising effectiveness found that “feeling nothing” is the most common response to ads, around 52% in the UK and 47% in the US across all TV advertising and worse for B2B, and that B2B uniquely under-funds its least-dull, most-effective work (System1, “The Extraordinary Cost of Dull”). If a chunk of spend is working that hard against itself, knowing which sources actually produce customers is the difference between cutting the dead weight and funding it for another year.

Good attribution is also legible to a non-specialist. The test is whether the owner, not just the analyst, can look at the report and make a call: this source produces customers at a sane cost, that one produces noise, move the money. If the report needs a footnote explaining why a third of the leads are “Direct,” it is not finished. Source-level detail, captured first-party at submission and weighted by who actually became a customer, gives you a report you can act on without a translator. That is the whole point: attribution exists to make a budget decision obvious, not to produce a dashboard that impresses and decides nothing.

That is the job: capture the real source, keep it attached, read the report by customer value. For the how, see how to track lead sources and the full list of lead source types; for the tools that do it, the best lead attribution software; for the foundation, the pillar on what a lead source is; and for the mechanism in the product, how Lead Source works.