Kntnt Ad Attribution

A privacy-friendly WordPress plugin for lead attribution that keeps all data on your own server — no personal data is sent to Google or any other third party. Works with any ad platform.

Description

Ad platforms like Google Ads offer conversion tracking features — such as Google's Enhanced Conversions — that improve attribution by sending hashed personal data (email addresses, phone numbers, names) from your website to the ad platform's servers. This raises significant privacy concerns: personal data leaves your domain, is transferred to servers that may be located outside the EU, and is used by the ad platform for its own purposes beyond your control. With the EU-US Data Privacy Framework under ongoing legal challenge and the possibility that it may be invalidated (as its predecessors Safe Harbor and Privacy Shield were), relying on such mechanisms creates regulatory risk for EU-based businesses.

Kntnt Ad Attribution takes a different approach. It gives you the same core benefit — knowing which ads actually generate leads — but keeps all data on your own server. No personal data is sent to Google, Meta, or any other third party.

Each ad gets a unique tracking URL (e.g. example.com/ad/a1b2c3…). When a visitor clicks an ad, your server records the click, stores the ad hash in a first-party cookie, and redirects the visitor to the landing page. When the visitor later submits a lead form, the server reads the cookie and attributes the conversion to the most recently clicked ad (filterable to support multi-touch models). The entire process happens on your infrastructure.

The plugin is platform-agnostic and works with any ad platform — Google Ads, Meta Ads, LinkedIn Ads, Microsoft Ads, or any other source that can link to a custom URL. This means you get a single, consistent attribution method across all your advertising channels.

The plugin does not hardcode integrations with any specific consent management or form plugin. Instead, it exposes hooks that you connect to your preferred plugins via your theme's functions.php, a mu-plugin, or a code snippet plugin.

Key Features

• Hash-based tracking URLs — each ad gets a unique /ad/<hash> URL (prefix configurable via filter), independent of ad platform.
• First-party cookie tracking — stores clicked ad hashes in a single HttpOnly, Secure, SameSite=Lax cookie (_ad_clicks), with a configurable lifetime (default: 90 days).
• Filterable last-click attribution — by default, the most recently clicked ad receives full conversion credit. The attribution model is filterable via the kntnt_ad_attr_attribution hook, enabling multi-touch models (e.g. time-weighted, linear, position-based).
• Deduplication — per-hash deduplication prevents the same tracking URL from generating duplicate conversions within a configurable window. Disabled by default (kntnt_ad_attr_dedup_seconds = 0); when enabled, each hash is independently checked against its last conversion timestamp.
• Cookie size management — stores a maximum of 50 ad hashes per visitor, pruning the oldest when the limit is reached.
• Campaign dashboard — view clicks, conversions, and fractional attribution per campaign for any date range, with CSV export. The date filter defaults to the two most recent complete calendar weeks (based on the WordPress "Week Starts On" setting). Individual click records include per-click Content, Term, Id, and Group fields.
• Settings page — configure cookie lifetime, deduplication, log file size limits, and queue retry parameters under Settings > Ad Attribution. Logging toggle and log file management (download, clear) are on the Tools > Ad Attribution page.
• Shared diagnostic logging — timestamped log file at wp-content/uploads/kntnt-ad-attribution/kntnt-ad-attribution.log, shared by core and add-on plugins. Controlled via the settings page. Sensitive values are masked.
• Queue management UI — view, retry, and delete individual queue jobs from the Report Queue table on the admin page.
• Three-state consent model — integrates with any cookie consent plugin via a filter hook, supporting yes, no, and undefined consent states with a transport mechanism for deferred consent.
• Platform-agnostic form support — integrates with any form plugin via an action hook.
• Bot detection — filters out known bots via User-Agent matching and robots.txt rules.
• Two redirect methods — 302 redirect (default) or JavaScript redirect via filter, providing flexibility for different ITP mitigation strategies.
• Companion plugin hooks — fires kntnt_ad_attr_click on every non-bot click with hash, target URL, campaign data, and access to URL parameters (gclid, fbclid, etc.). Companion plugins can capture platform-specific data and implement server-side API integrations without modifying the core plugin.
• Query parameter forwarding — ad platform parameters (gclid, fbclid, msclkid, etc.) appended to the tracking URL are automatically forwarded to the target page through the redirect. Target URL parameters take precedence, and the merged set is filterable.
• Adapter infrastructure for add-ons — a built-in adapter system lets add-on plugins or code snippets register click-ID capturers (for gclid, fbclid, msclkid, etc.) and conversion reporters (for Google Ads, Meta, Matomo, GA4, etc.). The core captures click IDs and processes a report queue; adapters define what to capture and where to report. If no adapters are registered, the plugin behaves identically to previous versions.

The Problem

Ad platforms tell you how many clicks an ad received, but not how many of those clicks turned into actual leads on your website. The standard solution is client-side conversion tracking — a JavaScript tag that fires when a form is submitted — but this approach has two categories of problems.

It is increasingly unreliable:

• Ad blockers prevent the tracking script from loading at all.
• Safari's Intelligent Tracking Prevention (ITP) limits the lifetime of cookies set in a cross-site context, causing conversions to go unrecorded if the visitor returns after a few days.
• Privacy-focused browsers (Firefox Strict Mode, Brave, etc.) strip or block tracking parameters like gclid before they reach your server.

It raises privacy concerns:

Ad platforms have responded to the decline in client-side tracking with features like Google's Enhanced Conversions and Meta's Advanced Matching, which improve attribution by sending hashed first-party data (email addresses, phone numbers, names) to the ad platform's servers. While the data is hashed before transmission, this approach has significant implications:

• Hashing is not anonymization. Regulatory bodies including the US Federal Trade Commission (FTC) have noted that hashed data can still enable identification of individuals. Under GDPR, hashed personal data remains personal data.
• Personal data leaves your domain and is transferred to the ad platform's servers, which may be located outside the EU.
• The ad platform uses the data for its own purposes, including automated bidding optimization and audience modelling, beyond the advertiser's direct control.
• The legal basis for EU-US data transfers is uncertain. The current EU-US Data Privacy Framework (DPF) is under active legal challenge. Its two predecessors — Safe Harbor and Privacy Shield — were both invalidated by the EU Court of Justice. A "Schrems III" ruling or political changes to the underlying US executive order could leave businesses without a valid transfer mechanism.

The result is a dilemma: you need attribution to spend your ad budget wisely, but the available solutions are either unreliable, privacy-invasive, or both.

How This Plugin Helps

Kntnt Ad Attribution solves both problems. It moves the tracking to the server side, eliminating the dependency on client-side JavaScript, and it keeps all data on your own server, eliminating the need to share personal data with third parties.

1. Each ad gets a unique server-controlled tracking URL (/ad/<hash>).
2. When a visitor clicks the ad, your server — not a JavaScript tag — records the click and stores the ad hash in a first-party cookie.
3. When the visitor later submits a lead form, the server reads the cookie and attributes the conversion.

Because the click recording and attribution happen on your server, they are immune to ad blockers and JavaScript-blocking browser features. The cookie is a standard first-party HTTP cookie set by your own domain, which makes it more resilient than third-party or JavaScript-set cookies (though Safari's ITP may still limit its lifetime — see Limitations).

Unlike Enhanced Conversions and similar features, the plugin never sends personal data — hashed or otherwise — to any external server. No email addresses, no phone numbers, no names. The only data stored is a list of opaque hashes in a cookie on the visitor's browser and aggregated click/conversion counts in your WordPress database. This means there is no third-country transfer issue and no dependency on the EU-US Data Privacy Framework or any other international data transfer mechanism.

Limitations

• ITP still applies. Safari may cap the cookie lifetime to 7 days when the visitor arrives from a classified tracking domain (such as Google). Conversions after that window are lost. A JavaScript redirect method (configurable via filter) may improve this in some cases, but there are no guarantees.
• No built-in feedback to ad platforms. The core plugin provides internal statistics only and does not include integrations with any external API. However, the adapter system allows add-on plugins to register click-ID capturers and conversion reporters for any ad platform or analytics tool. See Adapter System for details.
• Cookies can be cleared. If the visitor clears their cookies or uses a private/incognito window for the return visit, the attribution link is broken.
• Cross-device tracking is not supported. A visitor who clicks an ad on their phone but converts on their laptop will not be attributed.
• Impressions are not measured. Ad views occur on the ad platform and never reach the server.
• No multisite support. Version 1 does not support WordPress multisite.

Despite these limitations, server-side first-party cookie tracking captures significantly more conversions than pure client-side tracking, and gives you a reliable internal baseline for comparing ad performance.