# Lead capture form with UTM tracking, built and tested

A lead capture form in plain HTML with UTM fields, a spam trap and a thank-you redirect. We sent it to a live endpoint to see what survives the trip.

Author: Formgong
Published: 2026-11-03
Language: en
Canonical: https://formgong.com/en/blog/lead-capture-form/

A lead capture form asks for the least you need to follow up, usually a name and an email, in exchange for something the visitor wants. Give it hidden fields for the UTM tags: in our live test on 2 November 2026 the browser passed 0 of the 3 tags in the referrer, and the hidden fields delivered all 3. Add a hidden spam-trap field and send people to a thank-you page.

## Why do leads arrive without a source?

You run a newsletter, a couple of ads and a few posts, and a lead comes in through the form on your site. Was it the ad you pay for, or the newsletter that costs you nothing? If the form does not record that, you are guessing when you decide where to spend next month.

A lead capture form is any form that turns a visitor into someone you can contact: a price list request, a demo booking, a download, a quote. The form itself is simple. The two things that usually go wrong are losing track of where the lead came from and drowning the real leads in spam. We built one small form, sent it to a live form backend, and checked both.

## What survives the trip to the form backend?

We served the form below from a test page, opened it in Chrome from an address carrying the usual tags (`?utm_source=newsletter&utm_medium=email&utm_campaign=november-price-list`), filled in a test name and sent it once to Formgong's production endpoint. Then we sent one more post the way a simple bot would, with every field filled, including the hidden one.

The form below, opened in Chrome from an address with UTM tags and sent once to Formgong's live endpoint, plus one bot-style post, 2 November 2026.
What we checkedResult
Hidden fields after the page loadedutm_source = newsletter, utm_medium = email, utm_campaign = november-price-list
Page address the browser reported with the postOnly the site's origin, with no path and no UTM tags
Where the visitor ended upOur thank-you page, through the redirect field
What we receivedName, email and the three UTM values; email and Telegram notifications sent
A second post with the hidden spam trap filled inThe same thank-you page for the sender; filed as spam, no notification
The second row is the one to remember. With the form on one site and the form backend on another, Chrome sent only the origin of the page as the referrer, with no path and none of the UTM tags. That is the browser's default, and MDN's Referrer-Policy page describes it this way: for cross-origin requests it sends “the origin (only)”. A backend that tries to read the campaign from the referrer gets nothing. The hidden fields carried the tags through because they are part of the form data itself.

## What fields should a lead capture form have?

Three visible fields are enough for most offers. Name and email let you follow up. One optional qualifying question, here the company, tells you whether to call first. Every extra required field is one more reason for a visitor to leave, and you can ask the rest on the call.

The script copies the three UTM tags from the address into the hidden fields when the page loads, and cuts each to 100 characters so a mangled link cannot fill your inbox. It also records which page the form was on, which helps when the same form sits on several landing pages.

```html
<form id="lead" action="https://formgong.com/submit" method="POST">
  <input type="hidden" name="access_key" value="fk_your_access_key">
  <input type="hidden" name="_subject" value="New lead: price list">
  <input type="hidden" name="_redirect" value="https://your-site.example/thanks/">
  <input type="hidden" name="utm_source">
  <input type="hidden" name="utm_medium">
  <input type="hidden" name="utm_campaign">
  <input type="hidden" name="landing_page">
  <input type="text" name="botcheck" tabindex="-1" autocomplete="off" style="display:none">

  <label for="name">Name</label>
  <input id="name" name="name" autocomplete="name" required>

  <label for="email">Work email</label>
  <input id="email" type="email" name="email" autocomplete="email" required>

  <label for="company">Company <span>(optional)</span></label>
  <input id="company" name="company" autocomplete="organization">

  <button type="submit">Send me the price list</button>
</form>
<script>
  // Copy the ad or newsletter tags from this page's address into the hidden fields.
  var params = new URLSearchParams(location.search);
  var form = document.getElementById("lead");
  ["utm_source", "utm_medium", "utm_campaign"].forEach(function (key) {
    if (params.get(key)) form.elements[key].value = params.get(key).slice(0, 100);
  });
  form.elements.landing_page.value = location.pathname;
</script>
```

## How do you stop spam and send people to a thank-you page?

The `botcheck` field is hidden from people but present for bots that fill in every input. In our test the bot-style post was filed as spam with the reason “honeypot” and sent no notification. The sender still got the normal thank-you page, so a bot learns nothing about what gave it away. Our [honeypot guide](/en/blog/honeypot-form-field/) explains the trick in more detail, and the one on [stopping spam without a CAPTCHA](/en/blog/contact-form-spam-without-captcha/) covers what to add when bots get smarter.

The `_redirect` field sends people to your own thank-you page instead of a generic one. Use that page to say what happens next and when, and put your conversion tag there if you run ads. Formgong follows the redirect only when it stays on your own site, so nobody can borrow your form to send visitors somewhere else. The guide to the [thank-you page after a form](/en/blog/thank-you-page-after-form-submission/) covers the details.

## How should you tag your links?

Hidden fields only record what the link carries, so tag every link you control. Use the same few values everywhere: `utm_source` for where the link sits (newsletter, linkedin), `utm_medium` for the kind of channel (email, social, cpc) and `utm_campaign` for the offer. Write them in lower case. “Newsletter” and “newsletter” will show up as two sources.

Visitors who type your address or come from a link you did not tag arrive with empty fields. That is fine, as long as you read an empty source as “direct or unknown” and not as zero. Some visitors now come from an AI assistant, and our article on [leads from ChatGPT](/en/blog/leads-from-chatgpt/) shows how to recognise them.

## What should happen after the lead arrives?

A lead goes cold quickly, so the follow-up matters as much as the form. Send the price list or the booking link in the first reply, and answer the question they asked rather than pasting a sales pitch. When the job is done, ask for a review. That is how a lead form ends up feeding your social proof too.

## How does this work with Formgong?

The form above works with a Formgong access key and nothing else on your server. Formgong reads `utm_source`, `utm_medium` and `utm_campaign` from the fields, puts the source and campaign in each lead's notification and counts them in the form's analytics, and the optional `/fg.js` script fills the tags in for you without cookies. Leads arrive by email and Telegram on every plan. When the page also loads `/fg.js` or a Turnstile widget, so Formgong can tell a person sent the message, a lead still unanswered 15 minutes later gets you one reminder with a drafted reply.

The free plan is meant for real use. Formspree's plans page, which we read on 2 November 2026, describes its free plan as “for testing and development, limited to 50 submissions/mo.” Formgong's free plan takes 250 submissions a month, and the source report, the Telegram alerts and that 15-minute reminder come with it.

You can start from one of our [website templates](/en/website-templates/) with the form already wired in, add the help chat for visitors who prefer to ask first, and switch on review requests for leads. The [analytics docs](/en/docs/analytics/) explain the source report, and the [Formgong home page](/en/) has the rest.

## How do you track your leads?

If your form loses its UTM tags in a way this test did not catch, or you found a better way to keep them, tell us at [support@formgong.com](mailto:support@formgong.com). We will test it and add it here.

## What Formgong's free plan includes

- **Build the form or bring your own.** The [form builder](/en/tools/form-builder/) takes the colours and fonts from your site's address, with no sign-up; ready [form templates](/en/templates/) copy into your account; AI writes the fields from one sentence. Any hand-written HTML form works too.

- **Websites with the form already connected.** 28 free [website templates](/en/website-templates/) post to Formgong out of the box.

- **250 submissions a month on unlimited forms.** Spam does not count. Once a year, a busy month keeps delivering on credit until the 7th instead of stopping.

- **Everywhere you work.** Email to up to 3 people at once, [Telegram](/en/integrations/telegram/) with Reply and Handled buttons, [Google Sheets](/en/integrations/google-sheets/), [Notion](/en/integrations/notion/), and 3 signed [webhooks](/en/integrations/webhooks/) for Slack, Discord, Zapier, Make or n8n.

- **Emails to your customers in your business's name.** Formgong sends them under your business name and replies come back to you, with no email service of your own to set up: a review request to every lead, a reminder a visitor asked for, and review emails after an order with your logo and colours. People who agree can also go straight into your [Mailchimp, Klaviyo, Brevo, MailerLite or Kit](/en/docs/marketing-lists/) list. An automatic reply to each visitor is on Pro.

- **No captcha needed.** A server-side spam filter, a honeypot, allowed domains and a block list; add your own Turnstile key if you want one.

- **Files and voice.** Visitors can attach files, or record a [voice message](/en/docs/voice-field/) that arrives transcribed.

- **Made for AI-built sites.** A hosted form page and a contact button; step-by-step guides for sites built with [Lovable](/en/docs/lovable/), [Bolt](/en/docs/bolt/), [v0](/en/docs/v0/), [Replit](/en/docs/replit/) and [Base44](/en/docs/base44/); an [MCP server](/en/docs/mcp/) lets Cursor or Claude wire the form for you.

- **See what the form does.** [Analytics](/en/docs/analytics/) for views, starts, conversion and where each lead came from, and an alert when a form goes quiet.

- **One account for the rest.** Customer reviews and an [AI help chat](/en/docs/help-chat/) that answers visitors from your own pages, with every message in one inbox. Data is stored in the EU.

## Frequently asked questions

### What fields should a lead capture form have?

Name and email, plus at most one optional question that helps you decide how to follow up. Ask everything else after the first reply.

### How do I capture UTM parameters in a form?

Add hidden inputs named utm_source, utm_medium and utm_campaign and fill them from the page's address with a few lines of JavaScript.

### Why are my UTM tags missing from form submissions?

By default the browser sends only the site's origin as the referrer to another site, so the tags in the address do not travel with the post unless hidden fields carry them.

### How do I stop spam on a lead form without a CAPTCHA?

Add a hidden honeypot field. Bots fill it, people never see it, and the backend files those posts as spam.

## Sources and documentation

- [Formgong: Honeypot form field](https://formgong.com/en/blog/honeypot-form-field/)
- [Formgong: Thank-you page after a form](https://formgong.com/en/blog/thank-you-page-after-form-submission/)
- [HTML forms](https://formgong.com/en/docs/html/)

[Get a form key](https://formgong.com/en/#top)