Enterprise SaaS: direct attribution fixed with server-side tagging
Server-side tagging and Google Tag Gateway cut the share of CRM leads counted as direct from 53% to 38%, comparing the 2 months before the setup with the 2 months after. Blocked GA4 requests had been stripping the source from paid search and organic leads on their way to the CRM.
Tracking Audit, Build, then Care1.5 months with the client's web team
Server-side tagging results, channel by channel
The case measured one figure, the direct share of all CRM leads: 53% in the 2 months before the setup and 38% in the 2 months after. The other rows show where those 15 points went and which part of the build moved them.
| CRM channel | 2 months before | 2 months after | What moved it |
|---|---|---|---|
| DirectMeasured | 53%of all CRM leads | 38%of all CRM leads | Down 15 points. These are leads whose source now survives the trip from the click to the CRM. |
| Paid searchMechanism | Under-credited. Ad clicks whose GA4 request was blocked arrived in the CRM as direct. | Took back most of the 15 pointsPaid search and organic together. The published result does not split them. | Google Tag Gateway and the server container. The UTM fallback carries the campaign when the GA4 hit still fails. |
| Organic searchMechanism | Under-credited. Search visits from privacy browsers arrived as direct. | Google Tag Gateway. The document referrer fallback names the search engine when nothing else does. | |
| Consent choicesOneTrust | Each visitor's OneTrust choice decided which tags could fire. | Same banner, categories and rules. | Nothing. Consent stayed out of scope on purpose. |
Measured: the direct share of all CRM leads across the two windows. The paid search, organic and consent rows describe what changed in the setup; they were not measured one by one.
Trace one lead through the old and the new setup
Pick a path. Each lane follows the same lead from the click to its CRM record.
BeforeTags requested from a Google domain
- Ad clickgclid and UTM parameters in the landing URL
- GA4 requestSent to a Google domain and blocked
- Form submitNo source travels with the lead
- CRM recordDirect
AfterTags served from the site's own domain
- Ad clickSame URL, same parameters
- Google tagLoads from the site's own domain
- Server containerForwards the hit to GA4, with the UTM fallback beside it
- CRM recordPaid search
This path is why paid search looked weaker than it was. The repair sits at step two, where the request now stays first-party.
What the 53% to 38% result does not claim
A share of direct leads is easy to over-read. These are the edges of this one.
- Metric
- Share of all CRM leads counted as direct
- Window
- 2 months before vs 2 months after the server-side setup
- Change
- 53% to 38%, down 15 points
- Outside it
- The split by channel, and how much of the remaining 38% is true direct
Will server-side tagging recover every lost lead source?
Does server-side tagging bypass cookie consent?
Is the remaining 38% all tracking loss?
How long did this server-side tagging project take?
Why did 53% of leads look like direct traffic?
A lead keeps its channel only when the source survives three hand-offs on the way to the CRM. Here the GA4 hit was the weak link. Ad blockers and privacy browsers stopped it, and any lead that reached the CRM without a source was filed as direct.
- 1
The click
- Carries
- gclid and UTM parameters on paid visits, the referrer on organic ones
- Breaks when
- Redirects or link shorteners drop the parameters
Feeds the UTM and referrer fallbacks
- 2Main leak in this case
The GA4 hit
- Carries
- The session source GA4 attaches to the visit
- Breaks when
- An ad blocker or privacy browser blocks the request to a Google domain
Repaired by Google Tag Gateway
- 3
The form submit
- Carries
- Whatever source the page still holds when the lead is sent
- Breaks when
- The GA4 hit failed and nothing else on the page recorded the source
Where both fallbacks attach the source
The CRM record
A lead that arrives with no source attached is counted as direct. Nothing downstream can put the channel back.
Paid search and organic looked weaker than they were, and budget decisions were being made on those numbers.
of CRM form leads arrive with no GA4 client ID across Waftr client audits. The audits pass the client ID into the CRM as a hidden field on each form submit, then count the records that land without one. Ad blockers and Reject All are the two main causes.
How it was built: four server-side tagging changes in 1.5 months
A Tracking Audit set the scope first. Four changes then went live with the client's web team, and one part of the stack was left exactly as it was.
- BrowserOneTrust banner, unchanged
- 01Google Tag GatewayTags served from the site's own domain
- 02Server containerOwned by the client
- GA4Session keeps its source
- CRMLead arrives with its channel
- 01Google Tag Gateway
Google tags load from the client's domain instead of a Google domain, and ad blockers and privacy browsers stop those first-party requests less often.
- 02Server-side tagging
Hits pass through a server container the client owns before they reach GA4.
- 03UTM fallback
Paid traffic keeps its UTM parameters with the lead.
- 04Document referrer fallback
Organic visits keep the search engine as their source.
- Left alone: OneTrust
Banner, categories and rules unchanged. The project moved where tags load from and left the consent decision with the visitor.
- Tracking AuditSet the scope
- Tracking Build1.5 months with the web team
- Tracking CareMonthly retainer today
Server-side tracking service Safari ITP case: same layer, other leak
“Waftr listened to every team, from marketing operations to web operations, and found the right place to crack our attribution issues. We rely on them completely and work with them on a monthly retainer.”
Measure your direct share before you change anything
One CRM export gives you the number this case moved, and one test lead shows whether the same leak is open on your site.
- 1
Export 2 months of CRM leads with their source field.
- 2
Count the leads marked direct or left empty, as a share of all leads.
- 3
Open your site from a link with UTM parameters, switch an ad blocker on and submit one test lead. If it lands as direct, you have the leak from the paid search row.