Traffic sources, campaigns and attribution

What you will learn #

This chapter answers one question: where did my visitors come from, and how do I prove which of my campaigns and ads actually brought them in?

After reading it you will be able to: read the traffic-source breakdown and the Referral, Social Media, AI Referrals, UTM campaigns, Ad traffic and Internal searches reports; build a tagged campaign link; block a noisy or spammy referrer; read what people search for on your own site; and check whether ad blockers are hiding your ads from visitors. Everything here is a report you open from the signed-in dashboard, not a new install.

This chapter is a practical reference on top of the concept guides. It links the short guides and feature pages (they explain the why) and adds the exact click path, every control, the numbers you will see, and the limits to keep in mind. It does not re-explain what web analytics is, and it does not cover Google Search Console or the keyword rank reports (those are in SEO, keywords and Google tools).

Before you begin #

• You have signed in and a site is added to your Hitsteps account. Open the site's dashboard: the address is https://www.hitsteps.com/stats/<your-site-id>/dashboard/.
• The tracking code is installed and has been collecting. If you just installed it, allow up to about 30 minutes for the first visitors to appear.
• A date range with some data. Almost every report in this chapter has a date-range picker in the top-left corner; reports only show what was recorded inside that range.
• Who can see it: the owner and any users you have added to the site. None of these reports is paid-plan-only. (See the plan/access notes in the "Limits" section at the end.)
• Two reports have an extra data condition, not a price condition: the UTM campaigns and Ad traffic reports only render their table once Hitsteps has verified the reporting data for your site. Until that is ready, the page shows a short "not available yet" notice (details below). This is a data-preparation state, not something you turn on in Settings and not a plan gate.

Where to find it #

All of these live in the left menu of your site's dashboard. Here is the literal menu and the address bar for each (replace <your-site-id> with the number in your own URL):

On the dashboard itself (before you open any report), the same signals show up as small cards you can toggle on or off:

• Referral Links card: your traffic split into Direct / Search / Links / Social / AI with a percentage each.
• AI referrals card: the AI total, your top AI source, and a 7-day trend.
• Optional cards (added from "All widgets"): UTM campaigns, Ad traffic, and Internal searches, each with a button that opens the full report above.

If a report's numbers look empty, first widen the date range in the top-left corner. The standard empty message is: "Consider selecting a broader or different date range (located on the top left corner of this page)."

Step by step #

How traffic is classified

Before the reports, here is the five-way split you will see everywhere in Hitsteps (it is the "Referral Links" dashboard card and the basis for the Referral and Social reports). Hitsteps classifies each tracked visit by the referral, search, campaign and AI information available when the visit begins:

• Direct - visitors who typed your address or used a bookmark.
• Search - visitors who arrived through a search engine.
• Links - visitors who clicked a link from another website. (AI-assistant visits are not counted here; they go to AI.)
• Social - visitors who came through a social-media website.
• AI - visitors attributed to AI assistants such as ChatGPT, Copilot, Perplexity, Claude, Gemini and Grok.

Two things worth knowing about this classification:

1. AI is its own bucket. Visits from AI assistants are counted under AI Referrals and are excluded from the Referral totals and from the "Links" number, so your referral counts are not inflated by AI traffic.
2. The split depends on what the browser sends. It is constrained by missing referrers, redirects, privacy settings and your own tagging quality (see Attribution limits at the end). If a browser sends no usable referrer, the visit is Direct or "unknown", not a referrer.

The reports, one by one

Top Referrals (referrers / referring websites)

Open Referral → Top Referrals. This is the list of the websites that are sending you the most traffic.

What you see: - A summary total of referral traffic for the selected range. - A chart of the top 10 referrer domains by visit count. - A table ranking each referring domain, with a share bar and the number of visits, up to the top 100 domains. Click a row to see the visitors that came from that website.

Practical use: this is where you check who is actually sending you people and whether a new link, guest post or directory listing is producing visits.

Recent Referral Links

Open Referral → Recent Referral Links. This is a visitor-by-visitor feed of recent visits that arrived through a referral link (its own title is "Recent visitors who came via a referral link").

For each visitor you get a card showing: - the referring page (the exact URL on the other site that sent them, with its favicon and title), - the visitor (anonymized name, browser and operating system), - what they did: Viewed this link, Continued using the site, or Closed site.

There is a Report spam button on each card. If a particular site is sending fake or spam traffic, flag it; for genuine referral spammers you can also send the address to Hitsteps and they can block it system-wide.

Block Referral

Open Referral → Block Referral. Page title: "Block referrals from being counted as your website referrers."

Use it when a domain keeps showing up as a "referral" but you do not want it counted: - The table lists every address you have blocked (column: Website). - Click Block Address to add a new one.

Typical reasons: - Your own domain aliases. If you run your site under more than one host (for example example.com and shop.example.com), visits between them would otherwise count as "referrals" to yourself. Block the aliases to stop that. - Specific links you control that you do not want attributed to you. - Referral spam that you want to remove from your totals.

Exit Link and Exit Link Activity

Open Referral → Exit Link. This shows the external links on your site and how often visitors click them. The page's own wording: "Ever wondered if your visitors are clicking on the websites you link to? Are they clicking on your advertising links or the sites you recommend? This tool allows you to see how many times your links to other websites have been clicked by your visitors."

• Exit Link = the ranked list of outbound destinations by click count.
• Referral → Exit Link Activity = the recent feed of individual exit-link clicks.

Use this to see which of your recommended products, partners or affiliate links people actually click. Empty message: "No exit links were tracked in the selected date range."

Social Media

Open Referral → Social Media. This measures the traffic that arrived from social-networking sites.

What you see: - A headline: your website received X% of visitors from social networking sites (N hits from social media out of M incoming organic hits), for either the last N days or your selected date range. - A daily chart of social traffic over the range. - A per-network breakdown (the individual social networks that sent traffic).

Hovering the big percentage also tells you the rest of the mix in plain words: your direct, search, link and AI shares.

Note: if a report on this page is blank, widen the date range; the empty message is "No social media hits". The charts require JavaScript to be enabled in the browser.

There is a separate, optional social profile integration in site settings (linking a Facebook/LinkedIn etc. profile). That pulls a connected profile into your left menu and is a setup step, not one of the traffic reports. If you use it and it misbehaves, that is a support question, not something to fix here.

Internal searches (what visitors search on your site)

Open SEO → Internal searches. This records the terms people type into your own on-site search box, and ranks them by how often each is searched.

• A ranked table of search term → number of searches (top 100).
• Open the visitors/journeys behind a recorded query to see where those searches land.

Use it to find what your audience is actively looking for that your pages do or do not answer. Two practical notes: - It captures recognized site-search result pages (common result-page query names such as ?q=, ?query=, ?searchterm=, ?keyword= and similar). If your site's search uses a non-standard parameter name that Hitsteps does not recognize, those searches may not be captured. - It is a separate report from your external search keywords (what people type into Google/Bing). Those are in the SEO chapter.

AI Referrals

Open Referral → AI Referrals. This is the report for visits that came from AI assistants (ChatGPT, Perplexity, Claude, and others).

What you see: - An overview: the total of AI referrals in the range and a breakdown by AI assistant (the named agents below). - A record of the page views that were attributed to AI, so you can connect the source to the landing page and the rest of the visit.

The named AI sources Hitsteps recognizes are: ChatGPT, Microsoft Copilot, Perplexity, Claude, Google Gemini, Grok, DeepSeek, Meta AI, Mistral Le Chat, Poe, You.com, Phind, and NotebookLM. Hitsteps matches them either by a supported assistant's referrer host or by a supported source tag on the visit.

Be precise about what this is and is not: it counts website activity that reached your site and was attributed to an AI assistant based on recognizable referral evidence. It is not a measure of everything an AI model displayed or answered. For the concept and how matching works, read the public page AI Referral Tracking.

UTM campaigns

Open Referral → UTM campaigns. This is where you see the performance of links you have tagged with campaign codes. The page title is "UTM campaigns"; its intro is: "Explore the first campaign that acquired each visitor or their most recently observed tagged touch." There is also a shortcut at the top: Open automatic ad detection, which jumps to the Ad traffic report.

Step 1 - Build the tagged link. You do this on the public, no-login UTM campaign URL builder: UTM campaign URL builder. Fill in the fields and press Build, then Copy the generated link and use it in your campaign (email, social post, ad, etc.).

Source, medium and campaign are required; term and content are optional.

Step 2 - Read the report. Once tagged visitors arrive, open Referral → UTM campaigns.

• Attribution view toggle (top right): Acquisition (default) groups visitors by the first tagged campaign recorded during the range; Latest observed groups them by their most recently observed tagged campaign. The page is explicit that the latest-observed view is the visitor's current attribution profile, not conversion credit and not a full campaign history.
• Dimension tabs: Source, Medium, Campaign, Term, Content, Landing page. Pick one to group the table by.
• Top KPIs: Attributed visitors, Lifetime observations for these visitors, Goals in this period, Goal revenue, and (if you have WordPress order data) WordPress conversions and WordPress revenue.
• Table: one row per value of the chosen dimension, with Visitors, Lifetime observations, Goals, Goal revenue, WordPress conversions/revenue, and Last seen. In Acquisition view, a campaign's value links to the recent visitors filtered to that campaign; the Landing page column links to the actual landing URL.

A note the page shows about the revenue numbers: Goal revenue is the value you set on your Hitsteps Goals, added once per trigger, and is not advertising spend or WordPress order revenue.

Empty states (both are normal, not errors): - UTM reporting is not available yet This means reporting data for your site is not ready. It is a data-preparation state, not a plan limit and not something you configure. If it persists, contact support. - "No UTM-attributed visitors were captured in this period." You simply have no tagged traffic in the selected range. - "Goal conversion metrics are paused until the goals UTM report index verifier returns ready." The Goals columns show a dash until that index is ready; the campaign traffic still shows.

For the concept and the first-touch vs latest-observed explanation, read What is UTM tracking?.

Ad traffic (paid advertising)

Open Referral → Ad traffic. This automatically detects paid traffic from supported ad platforms using confidence-rated URL signals (the click IDs and campaign tags that ad platforms append to a link). You do not connect an ad account; Hitsteps reads the signals already present on the URL. Its intro: "Automatically detects paid traffic from supported advertising platforms using confidence-rated URL signals."

Supported platforms (from their click IDs / tags): Google Ads, Google Marketing Platform, Microsoft Advertising, TikTok Ads, LinkedIn Ads, X (Twitter) Ads, Pinterest Ads, Snapchat Ads, Reddit Ads, Yandex Direct, Taboola, Outbrain, and Meta (via the fbclid signal, which identifies a Meta-platform click and is treated as possible, not confirmed paid).

• Attribution view toggle: Acquisition (first advertising signal recorded) vs Latest observed (most recently observed). The visitor detail page shows the recorded ad-signal history.
• Dimension tabs: Platform, Channel, Paid status, Confidence, Signal conflict, Evidence, Campaign / ID, Ad group ID, Ad ID, Creative ID, Keyword, Network, Placement, Match type, Ad click device, Click ID type, Landing page.
• Top KPIs: Ad-attributed visitors, Paid visitors, Possible / unproven paid, Distinct touches, All observations, Signal conflicts, plus Goals / Goal revenue and (when present) WordPress conversions/revenue.
• Table: one row per value of the chosen dimension, with Visitors, Paid, Touches, Observations, Goals, Goal revenue, Conflicts and Last seen.

How to read the confidence / evidence values (this is the important part of the report):

Confidence buckets used in the Confidence column: high (≥95), declared (≥70), possible (≥40), unclassified.

Be precise about the limits: these are confidence-rated URL signals, not advertising-account API verification. Hitsteps does not read your ad account; it reads what is on the URL. That is by design, and it is why the report separates paid from possible and shows conflicts instead of guessing.

Empty states: Ad reporting is not available yet (same data-preparation state as UTM; not a plan limit), "No ad-attributed visitors were captured in this period."

For the concept and the full platform list, read Ad traffic.

Advertisement Blocking (ad-block detection)

Open Computer → Advertisement Blocking. This shows whether your visitors' browsers are blocking ads. The page's own wording: "This section shows whether your visitors' browsers are blocking ads. Some browsers, such as Brave or Opera, block ads by default, while visitors need to install ad-blocking extensions on other browsers."

• A table of Ad Blocking mode with a Usage % and Hits per mode.
• Empty message: "No ad-blocking data is available for your visitors yet. Please check back later."

Treat this as an estimate, not a guaranteed browser fact. It is a useful signal for "are a lot of my visitors blocking my ads?", but do not publish it as an exact per-browser guarantee. For the concept, read Ad Block Detection.

Worked example #

Say you run an online store at your-store.example and you want to know whether a spring email campaign and a Facebook post are worth their effort.

1. Tag each link before it goes out. Use the UTM builder: - Email: https://your-store.example/summer?utm_source=newsletter&utm_medium=email&utm_campaign=spring_sale - Facebook: https://your-store.example/summer?utm_source=facebook&utm_medium=social&utm_campaign=spring_sale
2. Send them, then widen your date range to cover the campaign window.
3. Read UTM campaigns grouped by Campaign = spring_sale (you see the total) and then by Source (you see the newsletter share vs the Facebook share) and by Medium (email vs social).
4. Connect it to outcomes. Set a Hitsteps Goal on your thank-you page (or use your WordPress order data). The UTM report then shows Goal revenue per source, so you can compare the two channels on value, not just visits.
5. If the traffic was paid, also open Ad traffic to see which visitors carry a high-confidence ad signal (paid) versus a platform signal that is only possible, and check the Signal conflicts count so you are not mixing a self-declared "paid" tag with a non-paid medium.
6. Watch the AI channel in the AI Referrals report and the AI share of the traffic split, in case a portion of your spring traffic is arriving through an assistant rather than through a traditional link.

This is the same flow the public UTM and Ad-traffic feature pages use in their examples; the numbers above are illustrative and yours will differ.

Controls and metrics #

Use the definitions below with the filters and access message shown for your website.

Problems and fixes #

1. "No data" on a report you just installed. The code is new. Allow up to about 30 minutes, and make sure the date range actually includes "today".
2. The date range is too small. Widen it in the top-left date picker. The reports only show the selected window.
3. UTM campaigns says "not available yet". Reporting data for your site is not ready yet. This is not a plan limit and not a setting you change. If it stays, contact support.
4. Ad traffic says "not available yet". Same data-preparation state as UTM; contact support if it persists.
5. I tagged my links but UTM shows nothing. Confirm the tags survived on the final URL (they are case-insensitive but must be present as utm_source etc.), that the tag is on the entry URL the visitor lands on, and that the date range covers when the visits happened. A redirect that drops the query string will lose the tags.
6. A referrer I don't want shows up (my other subdomain, a spammer). Block it: Referral → Block Referral → Block Address.
7. Google shows visits but no keyword. Expected. Google withholds the organic keyword as "[not provided]"; use the search-traffic totals rather than expecting the exact query.
8. Internal searches is empty. Your search box may use a query parameter name Hitsteps does not recognize, or there are no searches in the range. (Verify your site's search parameter name is recognized before relying on it.)
9. A campaign looks "paid" but is marked possible / conflicting. Look at the Evidence and Signal conflict columns. A mismatch between the click ID and your utm_medium declaration is the usual cause; fix the tag or accept the platform signal.

Access, privacy and limits #

Attribution limits - what to keep in mind

Read these before you quote any number from this chapter:

• Referrer data only exists if the browser sends it. HTTPS→HTTPS usually sends the referring page; but some browsers and Referrer-Policy settings send only the origin, or send nothing, and a visit from an HTTPS site to an HTTP target may lose the full URL. Private/incognito sessions and ad blockers can also strip it. When no usable referrer reaches the site, the visit shows as Direct or unknown, not as a referrer.
• Google sends "[not provided]" as the keyword for most HTTPS organic searches. So you will see strong search traffic counts, but the exact organic keyword often is withheld. The Recent keywords report only lists terms when a search engine or campaign actually passes them.
• UTM and Ad attribution are about URL signals, not ad accounts. "Latest observed" is the current profile, not conversion credit; Ad traffic uses confidence-rated signals, not API verification, which is why it splits paid vs possible and flags conflicts.
• Ad-block detection is an estimate, not a guaranteed per-browser fact.
• AI referrals are attributed from recognizable evidence, not a full measurement of everything an AI model displayed.
• Internal searches depend on your site using a recognized search-results URL pattern.

The public Traffic Source Analytics page summarizes the same point: classification is "constrained by missing referrers, redirects, privacy controls, and campaign tagging quality."

Data, privacy, plan, role and retention limits

• Plan: All of the reports in this chapter are part of the standard signed-in dashboard. None is gated to a paid plan. UTM campaigns and Ad traffic additionally require reporting data to be ready (a data-preparation state, not a price gate).
• Role: Owner and added users can view these reports. Blocking a referrer and flagging spam are account actions.
• What is stored (relevant to this chapter): referring domains and pages, the UTM values you tag (each value is cleaned and limited to 255 characters), ad click-ID evidence (the raw click ID is stored hashed, not in plain text), the recognized AI assistant host, and internal search terms.
• Privacy: Hitsteps tracking runs invisibly (no counter on your pages) and still follows your consent and privacy settings. For the full privacy story, opt-out and data handling, see the Privacy, data controls and tracking exclusions chapter and the public opt-out page.
• Retention: Data retention depends on your plan.
• What is NOT captured here and why: exact Google organic keywords (withheld), the full AI-model conversation (only the tracked site visit is counted), and ad-account spend (Hitsteps does not read ad accounts).

Related help #

• Manual hub: the full Hitsteps guide lives at /guide/.
• Sibling chapters you will want: Getting started and installation (if tracking isn't set up yet), SEO, keywords and Google tools (Search Console and keyword ranks), Actions, goals and funnels (the Goals used in UTM/Ad revenue), Privacy, data controls and tracking exclusions.
• Concept guides and feature pages this chapter builds on (public, no login):
• What is UTM tracking?
• UTM Campaign Tracking (has the link builder)
• Traffic Source Analytics
• Referral Traffic Tracking
• Ad traffic
• Ad Block Detection
• AI Referral Tracking
• Internal Site Search Analytics
• Top Search Keyword Reports and Recent Search Keyword Analytics
• FAQ: the public Support FAQ.

• If something is wrong or a report is stuck on "not available yet": use the in-app support contact / support.php. Report a bug rather than changing product behavior from inside this guide.

• All guide topics

• Frequently asked questions
• Contact support
• Dashboard, real-time and visitor reports
• Developer APIs and reporting connectors

Last checked #

Checked 8 November 2026 using product documentation and source, with public pages and safe sample screens where available. Account-specific access, provider controls and effective limits can differ; use the current message shown for your website. Examples are illustrative.