Sales sources

Where every paid order came from: channel, source, campaign and tracked link, how a visit is classified, and what is kept about the shopper.

Written 2026-09-29. Every paid order shows where it came from: a search engine, an AI assistant, a social post, a newsletter, an ad, another site, a tracked link, or a visit with no source at all. The Sales sources screen under Analytics adds it up for a period, so you can see which channel, post or campaign sells.

Nothing to switch on. Sources are recorded from the day your store started recording them; the screen and the tools say from when.

1. What you see

WhereWhat
Order listA small badge on each order: the channel and the source, such as "Instagram" or "Google".
Order pageA Came from card: who created the order, then for a shopper's order channel, source, campaign, landing page, link name, when the visit was first seen, and the first visit when it differs from the last. For an ad, the kind of ad click (never the click itself).
Sales sourcesA table by channel with paid orders and sales. Open a channel to see its sources, open a source to see its campaigns and tracked links. Orders without a source are one grey row, Not recorded. A Model switch picks how orders are credited (see Attribution models).

Channels: Direct, Search (search engines and AI assistants), Social, Email, Ads, Referral (another site or app), Tracked link and Other.

2. What is counted

Only paid orders count: paid, or paid and later refunded, dated by when they were paid. Sales are the order total less tax, before refunds. These are the same orders and the same sales as the paid orders and sales in Analytics for the same period, so a source never shows more orders than Sales does. Unpaid, failed and abandoned checkouts are not counted.

Bots, link previews, prefetches, the page builder and preview links are never a visit, so they never set a source.

3. How a visit is classified

A source is read when a shopper opens a store page in a browser tab: from the address they landed on and the site that sent them. Cart, checkout, account pages, tracked link redirects and links inside emails are not landing pages. The first rule that matches decides the channel.

OrderRuleChannelSource
1The address carries a tracked link (fh_link=<code>)Tracked linkutm_source, if any
2An ad click id other than fbclidAdsutm_source, or the network of the click id
3A utm_medium from the list belowThat medium's channelutm_source, or the known site that sent them
4fbclidSocialutm_source, the social site that sent them, or Facebook
5utm_source aloneThe channel of that name when it is known, else Otherutm_source
6Sent by a known site or appThat site's channelThe site's name
7Sent by any other site or appReferralThe site's host name, such as blog.example.org
8Only other campaign tags (utm_campaign, utm_content, utm_term, or a medium not in the list)Othernone
9Nothing at allDirectnone

Mediums (utm_medium, compared in lower case):

ChannelMediums
Adscpc, ppc, paid, ads, ad, paidsearch, paid-search, paid_search, paidsocial, paid-social, paid_social, paid social, display, cpm, cpv, cpa, retargeting, remarketing
Emailemail, e-mail, e_mail, newsletter, mail
Socialsocial, social-media, social_media, social media, organic-social, organic_social, sm
Referralreferral, affiliate, partner
Searchorganic, search, seo

Ad click ids. gclid, gbraid, wbraid and dclid (Google), msclkid (Bing), ttclid (TikTok), epik (Pinterest), twclid (X), li_fat_id (LinkedIn), sccid (Snapchat), rdt_cid (Reddit), yclid (Yandex) and fbclid (Facebook and Instagram). An order shows the kind of click as gclid, fbclid, ttclid, msclkid, epik or other.

Known sites. A subdomain counts as its site, and the most specific name wins, so gemini.google.com is Gemini, not Google.

ChannelSites and apps
Search enginesGoogle, Bing, DuckDuckGo, Yahoo search, Yandex, Baidu, Ecosia, Brave search, Startpage, Qwant, Naver, Kagi, Coc Coc, and the country sites of Google, Bing, Yahoo and Yandex (google.de, google.co.uk)
AI assistants (Search)ChatGPT, Perplexity, Claude, Gemini, Copilot, You.com, Phind, Mistral, Meta AI, Grok, DeepSeek
SocialFacebook and Messenger, Instagram, Threads, X, TikTok, Pinterest, YouTube, LinkedIn, Reddit, Snapchat, WhatsApp, Telegram, Discord, Tumblr, Bluesky, Mastodon, Zalo, LINE, VK, Weibo, and the Android apps of most of them
EmailGmail, Outlook and Yahoo Mail on the web, and the Gmail and Outlook apps on Android

Short utm_source names are read in full: ig is Instagram, fb Facebook, yt YouTube, twitter X. A utm_source written as a site (chatgpt.com) is that site's name. newsletter is Email.

Never a source: your own store's addresses, the payment pages a shopper returns from, and Formahand's own sites.

Examples

Landing address (and the site that sent them)Result
/products/mug?utm_source=instagram&utm_medium=social&fh_link=anna-igTracked link, Instagram, link anna-ig
/?gclid=abc123 (from google.com)Ads, Google, ad click gclid
/?utm_source=ig&utm_medium=paid_social&utm_campaign=fallAds, Instagram, campaign fall
/?fbclid=xyz (from m.facebook.com)Social, Facebook, ad click fbclid
/?utm_source=newsletterEmail, Newsletter
/?utm_source=partnerblog&utm_medium=affiliateReferral, Partnerblog
/products/mug (from google.de)Search, Google
/ (from chatgpt.com)Search, ChatGPT
/ (from gemini.google.com)Search, Gemini
/ (from blog.example.org/best-mugs)Referral, blog.example.org
/ (from the Gmail app)Email, Gmail
/?utm_campaign=springOther, campaign spring
/ (typed, or from a bookmark)Direct

Tags are kept in lower case, up to 120 characters each.

4. First touch and last touch

A shopper often comes back more than once. The first visit that carries a source is the first touch. Every later visit with a different source becomes the last touch; a visit with no source (typed in, a bookmark) changes nothing, and the same source again is not a new touch. The order is counted under the last touch. The order page shows the first one too, as First visit, when it differs.

4a. Attribution models

A model decides which source gets the credit when more than one source touched an order. The default is Last non-direct click.

ModelCredits
Last non-direct click (last-non-direct)The last visit with a source before the order, within 30 days. Direct visits never count.
Last click (last)The last visit before the order; direct visits are never a touch, so this matches Last non-direct.
First click (first)The first visit with a source within 30 days before the order.
Linear (linear)The order and its sales split evenly across every source that touched it.
Any click (any)Every source that touched the order gets the whole order, so the rows add up to more than the total.
  • Touches. The touches of an order are every visit with a source in the shopper's session, plus the first touch and the last touch the checkout carried. The same source twice in a row is one touch.
  • 30 days. A touch older than 30 days before the order is left out.
  • Direct is never a touch. A typed address or a bookmark changes nothing, so Last click equals Last non-direct click today.
  • Linear splits an order and its sales evenly, so a source can show a fraction of an order, such as 0.5. The leftover cent goes to the last touch.
  • Any click gives every touched source the whole order. The rows add up to more than the total; the total stays the true count of paid orders and sales.
  • No touches. An order without touches stays under its recorded source, or under Not recorded.

Switch the model with Model on the Sales sources screen. One line under the table says what the chosen model credits. Agents pass model to get_order_sources (see For agents).

5. Not recorded

Not recorded means the order has no source:

  • it was placed before your store started recording sources,
  • the shopper refused tracking on a store that asks (see Privacy), or
  • the checkout did not carry the source (see Limits).

6. Orders you or an agent make

An order made in the dashboard or by an agent (a phone or counter sale, a payment link) reads Made in the dashboard or Made by an agent, under channel Other. A shopper who later pays it changes nothing.

7. Privacy

  • No new cookie. The source travels inside the cart cookie the shopper already has, on their own device, for up to 30 days. It is removed when the order is placed, or as soon as the shopper refuses tracking.
  • No visitor profile. The source is written onto the order when the order is placed. The touches of a visit are kept under a daily visitor hint with no cookie, and deleted after two days (Analytics).
  • Asked only when you use pixels. While no pixel is on (Analytics, Pixels), your store asks nobody and records where every order came from, for every shopper in every country. It adds no cookie and sends nothing outside your store.
  • Once a pixel is on, the shopper's tracking choice is respected. Refused: nothing is recorded and a source already kept is removed. Where the shopper must be asked first and has not answered yet, nothing new is recorded. With Do not ask, every order is recorded.
  • Ad click values. The value of an ad click id identifies one click. It is kept only when the shopper said yes, or when you chose Do not ask yourself; a store that asks nobody only because no pixel is on keeps the kind of click, not its value. It is kept only on the order, and it is never shown on screens or returned by the tools. The order shows only its kind.
  • Never stored: an IP address, the browser string, the page the shopper came from beyond its host name, the query of the landing address, or a visitor profile.
  • A source is kept as long as its order and is deleted with it. It is not sold and not sent to any ad platform.

Add campaign tags to the links you share: utm_source (where: instagram, newsletter), utm_medium (what kind: social, email, cpc) and utm_campaign (which campaign: fall-sale). For one post, influencer or flyer, a tracked link is simpler: it adds the tags for you and shows clicks beside the orders.

9. For agents

  • get_order_sources { from?, to?, model? } (orders:read) answers the Sales sources table for a period: period, currency, since (when sources started being recorded, empty until the first one), totals (orders, revenueMinor, recordedOrders, unknownOrders), channels (each with its sources, each with its campaigns and tracked links), unknown, plus summary (sentences ready to quote, such as "Instagram (social): 12 orders, 340.00 USD") and notes. model is last-non-direct (the default), last, first, linear or any (see Attribution models); the answer carries model and modelNote, the one sentence that says what the model credits. Under linear an order count can be a fraction. The period rules are those of get_analytics: ISO days in the store's timezone, the last 30 days by default, at most 366 days. Money is in minor units of currency.
  • Every order from list_orders and get_order carries cameFrom: channel, sourceName, campaign, medium, content, term, clickIdKind, linkCode, landingPath, referrerHost, firstSeenAt, unknown (true when not recorded), recordedBy (shopper, dashboard or agent) and first (the first touch when it differs). create_order answers it too.
  • export_orders adds the columns came_from_channel, came_from_source, came_from_campaign and came_from_link, blank when not recorded.
  • The same table over the API: GET /api/order-sources?storeId=&from=&to=&model= with a token holding orders:read.

10. Limits

  • A custom front end that sends shoppers to checkout on its own does not carry the source yet; its orders read Not recorded. The checkout forms on your store's own pages carry it.
  • Counts follow Analytics: the same paid orders and the same sales definition.
  • Bots, link previews and prefetches are not counted.
  • A shopper who clears cookies, or switches device between visit and order, starts again with no source.
  • A model only sees touches recorded from the day sessions started being measured. An order paid before then has no touches and stays under its recorded source in every model.