UTM Parameters: The Complete Guide for 2026
utm_source, utm_medium, utm_campaign and friends — naming conventions that survive growth, mistakes that corrupt attribution, and how cookieless analytics captures them.
UTM parameters are the oldest trick in web analytics — five query-string fields from the Urchin era — and still the single highest-leverage habit in marketing measurement. They cost nothing, work in every tool, survive cookie deprecation entirely, and yet most companies' UTMs are an archaeological dig of inconsistent spellings. This guide is the convention document you can adopt as-is.
The five parameters and what each is actually for
| Parameter | Question it answers | Good values |
|---|---|---|
utm_source | Which platform sent the click? | google, beehiiv, x, linkedin, producthunt |
utm_medium | What kind of channel is it? | email, cpc, social, referral, podcast |
utm_campaign | Which initiative? | jun_2026_launch, black_friday_2026 |
utm_content | Which variant/placement? | header_cta, footer_link, variant_b |
utm_term | Which paid keyword? | analytics+privacy (paid search only) |
Source and medium are mandatory on every external link you control. Campaign is mandatory for anything you will want to evaluate later. Content and term are optional refinements.
Conventions that survive growth
- Lowercase everything. UTMs are case-sensitive strings: Email, email, and EMAIL are three channels in your reports. Pick lowercase and never look back.
- Underscores, not spaces. Spaces become %20 and read horribly in dashboards.
- Date your campaigns: jun_2026_launch beats launch2 in every report you will read a year from now.
- source = platform, medium = category. The classic mistake is utm_source=newsletter. The source is beehiiv; the medium is email. Get this right and channel rollups work automatically.
- Never tag internal links. A UTM on an internal link overwrites the visitor's real acquisition data with self-referral garbage. UTMs are for inbound traffic only.
- Keep a shared registry. A simple spreadsheet of campaign slugs prevents the drift that ruins year-over-year comparisons.
First-touch capture: where UTMs become attribution
A UTM identifies one click. Attribution needs that click remembered when the visitor returns next week as 'direct' and pays. That requires your analytics to store the first-touch UTM set on the visitor record permanently — not just on the session. Clycyo does this automatically on the very first pageview; the values are still attached when an identified user pays via a Stripe webhook months later. No cookies involved: this is first-party data on a first-party record, which is why UTM-based attribution keeps working in a cookieless world.
UTMs and SEO: the canonical question
UTM-tagged URLs can appear in search indexes as duplicates if linked publicly. Defenses: a rel=canonical tag on every page pointing at the clean URL (every modern framework does this), and avoiding UTMs in indexable contexts like guest posts where a plain link serves better. For email, ads, and social, tag freely.
Debugging checklist
- Campaign missing from reports? Check for typos and case drift first — utm_campaign=Jun_2026 is a different campaign than jun_2026.
- Everything showing as direct? Your link shortener or email platform may be stripping query strings; test the final resolved URL.
- Numbers split between two sources? Someone tagged the same campaign with twitter and x. The registry (rule 6) exists for this.
Adopt the table, enforce the six rules, and UTMs become what they were always meant to be: a free, durable attribution layer that no privacy regulation will ever take away. The next layer up — joining those tags to signups and revenue — is covered in Revenue Attribution for SaaS.