Form Scanners Missed 9 of 17 Confirmed UTM Captures

A static form scan can find campaign fields that are already visible in a page, but it cannot prove what a form sends when somebody clicks submit. We tested that gap on a deliberately selected validation set: 23 public B2B forms were attempted, and 20 produced a definitive submission-payload result.

In those 20 definitive cases, the scanner detected 8 of 17 payload-confirmed campaign-data captures and missed 9. This is a validation result for the selected cases, not an estimate of how often all B2B forms capture campaign data.

The finding, in one sentence

In a deliberately selected validation set of 20 B2B forms with definitive payload results, a static audit detected 8 of 17 payload-confirmed campaign-data captures and missed 9. The result demonstrates false negatives in this audit method. It does not establish a market-wide capture rate or a universal undercount multiplier.

Why this study exists

UTMs and click-IDs can help a B2B company connect a lead with the campaign that generated it. This study tests one narrow layer of that process: whether sentinel campaign values appeared in an observable form-submission payload. It does not test downstream CRM storage, mapping, or reporting.

How we measured it (and why the easy method lies)

We started with an automated audit of 150 public B2B demo, contact, and signup forms. A read-only script loaded each form carrying a test UTM and click-ID, then inspected the page’s form fields, cookies, and dataLayer. It produced a tidy number: 29% (44 of 150) capture the UTM into an actual form field.

We did not trust it, for a simple reason: a script reading the page can only see what is in the page. It cannot see what a form adds to the network request at the instant you hit submit. So we hand-validated a stratified sample of 23 forms the only way that settles the question — by submitting one real test lead to each and reading the actual submission request.

The protocol, applied identically to every form:

• One submission per form, from a single dedicated address on our own domain, then stop. No automation, no resubmission.
• Each form was reached through a unique tagged URL (utm_source=ivris-research … gclid=ivrisHAND-<n>), so any captured value is unambiguously ours.
• We read the actual submission POST body and searched it for our sentinel values.
• Capture counts only if the value is in the observed submission payload. Analytics pixels, request headers, the Referer, first-party cookies, and the page URL alone do not count.
• Where the real payload could not be observed (server-rendered, third-party iframe, or a blocked route), the form is recorded as unverifiable and excluded — never guessed.

The 23 attempted cases were selected across the scanner’s three verdict classes and deliberately weighted toward suspected false negatives: 7 scanner verdicts were none, 7 were cookie/dl-only, and 9 were form-field. Three attempts were unverifiable (AgencyAnalytics, Customer.io, Buildertrend), leaving 20 forms with a definitive payload result.

What the hand pass found

Among those 20 definitive cases, 17 transmitted a UTM or click-ID in the observed submission payload and 3 did not. The 17/20 proportion describes this selected validation set only. It cannot be compared as a rate with the scanner’s 44/150 parent-sample result because the samples have different compositions and the validation set was intentionally enriched for suspected misses.

The three genuine misses were Dreamdata (a Squarespace form that posted only its visible fields), HockeyStack (the UTM field names were present but the values were blank, and the tag was lost on a redirect), and Attio (a custom API that posted a clean, contact-only body). The interesting part is how the other 17 captured:

The validation result: the scanner missed 9 of 17 confirmed captures

Lining up the scanner’s prediction against the observed payload result, form by form, on the 20 definitive cases:

The defensible conclusion is narrow: this scanner produced substantial false negatives in the selected validation cases. A positive result matched all eight definitive positive calls in this set, while a negative result did not rule out capture. The study does not estimate the scanner’s market-wide error rate, and it does not justify multiplying 29% by three.

Descriptive subgroup counts, not a vendor-type comparison

Among definitive cases, 9 of 11 attribution or analytics specialists and 7 of 8 general SaaS companies transmitted campaign data in the observed payload. These are descriptive counts from a small, purposively selected set. The study was not designed or powered to test whether the two groups differ.

The full dataset — all 23 forms

Every form we attempted, the platform behind it, what the automated scanner concluded, and what we found by reading the actual submission. Rows where the scanner said “none” or “cookie-only” but the form did capture are its blind spots.

The arrow (→) marks the nine forms where the automated scanner predicted “no capture” but the form did capture — its blind spots. The UTM survived the homepage→form journey on 20 of the 22 forms where that was observable (≈91%).

Two clean findings from the wider 150-form audit

The capture calibration cannot be generalized to the parent sample. Two separate DOM-observable counts from the 150-form audit can still be reported descriptively:

• Bot protection ≈ 47%. Of 150 forms, 71 use a managed CAPTCHA (56 reCAPTCHA, 13 Cloudflare Turnstile, 2 honeypot); 79 use none. A floor, since silent honeypots are undercounted.
• “How did you hear about us” is rare — ≈15%. Just 23 of 150 forms ask, and only 12 make it required. And 31 of the 40 martech sellers in the sample (78%) don’t ask at all — the companies most equipped to value self-reported attribution mostly skip it.

Methodology and provenance

This page reports a diagnostic validation exercise on a small, purposively selected sample, not a market-wide census. The corrected analysis compares scanner predictions and payload results only within the same 20 definitive cases.

• Parent sample: 150 public B2B demo/contact/signup forms, automated read-only audit, collected June 2026.
• Validation subsample: 23 attempted forms — 7 scanner verdicts of none, 7 of cookie/dl-only, and 9 of form-field — deliberately weighted toward suspected false negatives. Submitted and inspected on 2026-06-17; 20 produced definitive payload results.
• Capture definition: a UTM or click-ID present in the actual submission POST body. Headers, cookies, referrers, analytics pixels, and page URLs explicitly excluded.
• Evidence: a payload artifact or collection note was preserved for each attempted case. Per-vendor observation notes are published in the dataset; underlying screenshots and transcriptions are retained locally.
• Analysis: sensitivity, specificity, precision, false-negative rate, and accuracy use only the 20 definitive same-sample cases. Wilson 95% intervals are reported for proportions.

Three later expansion attempts — Trigger.dev, Replit, and Toggl — produced no observable client-side lead payload and remain unverifiable. They are not confirmations of capture or non-capture and are excluded from every metric.

Frequently Asked Questions

Version history and corrections

To report a factual error, identify the disputed row or passage and provide the supporting technical evidence through the IVRIS Tech contact route. Material corrections will be dated on this page rather than silently replaced.

Research and analysis by Mahesh Sirvi, IVRIS Tech. The methodology and public 23-row dataset are available for inspection. Supporting payload observations were checked locally, but the underlying screenshots and transcriptions are not all published as reusable artifacts.