UTM parameters explained: the five tags and how to use them
UTM parameters are query-string tags you add to a link so analytics can attribute the visit to a campaign even when the referrer is missing. This page explains the five tags, a consistent naming convention, and the hard rule that UTM values are public — so they must never contain personal data or secrets.
The five UTM parameters
There are five standard tags. Three are essential and two are optional:
- utm_source — where the traffic comes from (e.g. reddit, newsletter)
- utm_medium — the channel type (e.g. social, email, cpc)
- utm_campaign — the specific campaign name (e.g. spring-launch)
- utm_term — optional, for paid-search keywords
- utm_content — optional, to A/B distinguish links/creatives
A naming convention that survives reporting
Pick one convention and never deviate: lowercase, hyphen-separated, no spaces. utm_source=Reddit and utm_source=reddit are two different rows in most tools. Keep a short documented list of allowed sources and mediums so links built by different people still aggregate.
What never belongs in a UTM
Because the URL is public and logged everywhere, UTM values must be safe to expose. Never encode a person's name, email, account ID, or any secret. Use stable, generic campaign labels — not per-user strings.
How it appears in analytics and logs
A visit carrying utm_* parameters tells you exactly which campaign, source, and medium drove it — independent of the referrer. Inconsistent casing or naming fragments the same campaign across multiple rows in reports.
Diagnostic use case
Build campaign links that attribute reliably, with a naming convention your reports can group cleanly.
What WebmasterID can help detect
WebmasterID reads utm_* parameters at ingest and attributes the visit to a campaign, giving you a reliable source even when the browser sends no referrer. It is strict about utm_* only — no gclid/fbclid-style identifiers.
Common mistakes
- Inconsistent casing/spelling fragmenting one campaign across many rows.
- Putting PII or tokens into utm_* values.
- Using utm_medium for the source (or vice versa), breaking channel grouping.
- Tagging internal links, which can reset the session source.
Privacy and accuracy notes
UTM parameters are visible in the URL, browser history, and logs. Never put names, emails, user IDs, or secret tokens in them. WebmasterID stores only utm_* campaign fields and rejects PII-shaped campaign data by convention.
Related pages
- Reddit campaign tracking with UTM parameters
Because so much Reddit traffic loses its referrer, UTM tagging is the reliable way to measure Reddit. This page gives a recommended utm_source/utm_medium/utm_campaign structure for Reddit links, worked examples, and the common mistakes that send Reddit visits into 'direct'.
- Direct traffic: what it really means
Direct traffic is the bucket analytics uses when no referrer is available. It includes genuine type-ins and bookmarks, but also a large share of visits whose referrer was stripped — app opens, HTTPS-to-HTTP transitions, shorteners, and privacy settings. Treating 'direct' as a single intent is the classic analytics mistake.
- Reddit referrer traffic: what it means and why it's undercounted
Reddit can be a strong traffic source, but a large share of it is invisible to referrer-based analytics: links opened in the Reddit mobile app, privacy settings, and link shorteners strip or hide the referrer. This page explains what a Reddit referrer means and how to measure Reddit reliably with UTM tags.
- Campaign links (docs)
How WebmasterID's link builder generates UTM-tagged URLs.
Sources and verification notes
- MDN — URL search paramsUTM tags are ordinary query-string parameters.
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.