See which channel, campaign and landing page brought every order, with revenue by channel.
Available Updated Oct 22, 2026Version 1.0.0CS-Cart, Multi-Vendor 4.17.2 – 4.21.x No core file edits
Built for
Order Source & UTM Attribution: overview1 of 15
What it does
CS-Cart does not record where an order came from. This add-on saves the source with every new order: UTM tags, ad click IDs of Google, Microsoft, Meta, TikTok and other networks, the referring site and the landing page, for the first and the last visit. Orders are sorted into channels such as paid search, social, email, AI assistants, referral and direct. For stores that advertise, send newsletters or work with affiliates, on CS-Cart and Multi-Vendor.
How it works
A light script reads the campaign tags and the referring site and keeps the touches in a first-party cookie after consent (Kavio Labs Cookie Consent Mode), otherwise for the current visit only. At checkout they are saved with the order. Admin orders are marked manual, API orders API. The order page has a source panel, the order list a column and filter. Multi-Vendor: vendor orders inherit the source and vendors see their own report. Full page cache safe.
Features
First and last touch on every order: source, medium, campaign, term, content, referrer, landing page
Ad click IDs recognised: gclid, gbraid, wbraid, dclid, msclkid, fbclid, ttclid, twclid, li_fat_id, epik, sccid, rdt_cid, yclid, plus your own parameters
Automatic channels: paid search, paid social, display, organic search, organic social, AI assistants, email, SMS and push, affiliates, referral, direct
Order sources report by channel, source / medium, campaign or landing page, last or first touch, with drill-down and CSV export
Source panel on the order page and source column and filter in the order list
Consent aware cookie, query strings of referrers never stored
Manual (admin) and API orders marked
Multi-Vendor: vendor orders inherit the source, vendors see their own report
Full page cache safe; REST API field on orders
What you get
Package
kv_order_source_attribution-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support
12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License
1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
For developers
Uses 9 CS-Cart PHP hooks. No core files are changed.
Compatibility
We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.
CS-Cart version and edition compatibility
CS-Cart version
CS-Cart
CS-Cart Ultimate
Multi-Vendor
Multi-Vendor Ultimate
4.22 and later
Testing next
Testing next
Testing next
Testing next
4.21.2
Supported
Supported
Supported
Supported
4.20.x
Supported
Supported
Supported
Supported
4.19.x
Supported
Supported
Supported
Supported
4.18.x
Supported
Supported
Supported
Supported
4.17.2
Tested
Supported
Tested
Supported
Before 4.17.2
Not supported
Not supported
Not supported
Not supported
Last tested build: CS-Cart 4.17.2, Oct 22, 2026Tested on: CS-Cart 4.17.2, Multi-Vendor 4.17.2
Requirements
Platform
CS-Cart 4.17.2 – 4.21.x, or CS-Cart Multi-Vendor 4.17.2 – 4.21.x
PHP
PHP 7.2.5 – 8.3, as supported by your CS-Cart version
Platform
A license key from cs-cart.kaviolabs.com or a CS-Cart Marketplace license number
Core changes
None. Hooks and template overrides only
1.0.0
Oct 22, 2026
Latest
Added 11
First and last touch saved with every new order: UTM source, medium, campaign, term and content, ad click IDs (gclid, gbraid, wbraid, dclid, msclkid, fbclid, ttclid, twclid, li_fat_id, epik, sccid, rdt_cid, yclid and own parameters), referrer (without query string) and landing page.
Automatic channels: paid search, paid social, display, organic search, organic social, AI assistants, email, SMS and push, affiliates, referral, other campaigns, direct; manual (admin) and API orders marked; extra search engines, social networks, AI assistants, own domains and ignored referrers in the settings.
Consent-aware storage: first-party cookie after consent in Kavio Labs Cookie Consent Mode, otherwise the current visit only (or nothing); attribution window setting.
Orders > Order sources report: period, last or first touch, grouping by channel, source / medium, source, medium, campaign or landing page, channel drill-down, share of revenue, links to the orders, CSV export, reclassify tool.
Order source panel on the order page, Source column and source filter in the order list.
Customer first source (registration or first order).
Multi-Vendor: vendor orders inherit the source of the main order; vendors see their own orders' sources and report.
REST API: kv_source_attribution in order responses.
Full page cache safe storefront capture (CS-Cart 4.21).
Domain-bound license check with the License card, status bar and badge.
Self-healing upgrades (Upgrade synchronizer).
Tested on CS-Cart 4.17.2, Multi-Vendor 4.17.2. First release.
Do I need Google Analytics or another tracking service?
No. Everything is recorded and reported inside CS-Cart. The add-on works next to Google Analytics, Meta Pixel and our tracking add-ons without changing them.
Why do my older orders show "Not tracked"?
Sources are recorded from the moment the add-on is installed. Orders placed before, orders placed while recording was off, and orders of shoppers who did not consent (with Without consent = Do not record) are shown as "Not tracked".
Is it GDPR friendly?
With the default settings and Kavio Labs Cookie Consent Mode, the kv_osa cookie is only set after the visitor allows the chosen category. Without consent the source is kept in the browser tab for the current visit only (no cookie), or not at all if you choose Do not record. Query strings of referring pages, which can contain personal data, are never stored. Without a consent tool on your store, the cookie is used right away (setting After consent); choose Never if you need cookie-free tracking. Mention the cookie in your privacy policy.
A customer paid on PayPal and came back. Is PayPal now the source?
No. Payment providers and Google sign-in are on the Ignored referrers list, and in CS-Cart the order is created before the payment page opens anyway. Add other payment or login hosts on the Channels tab.
Why is a visit from Facebook "Organic social" and not "Paid social"?
Facebook adds fbclid to organic and paid links alike. Tag your ads with utm_medium=paid_social (or cpc) and they are counted as paid social.
Does it work with the full page cache of CS-Cart 4.21?
Yes. The source is read in the shopper's browser; cached pages are identical for everyone and storefront page views write nothing on the server.
Does it slow down the storefront?
No. The script is small, runs once per page and sends data only from the cart and checkout pages.
What happens without a valid license?
Without a valid license (no key after the 14-day start period, an invalid or revoked key, a domain the license does not cover, or no successful check for 14 days), new visits and orders are no longer attributed: the storefront script stays off and new orders get no source. Stored sources, the order panel, the order list filter and the report stay available, and checkout is never affected. Once the license is valid again, recording continues.
The admin panel shows a license notice.
Open Add-ons → Manage add-ons → Order Source & UTM Attribution: the License card at the top says what is wrong. Fix it on the License tab and click Check now. See License.
Does the add-on work on my staging copy?
Yes. Subdomains of your licensed domain and local development hosts (localhost, private IP addresses, .local, .test) are covered by the same license.
What happens if your license server is down?
Nothing changes for 14 days: the add-on keeps working and retries every hour. Only if no check succeeds for 14 days is it switched off until the next successful check.
Does the license check slow down my storefront?
No. The check runs only in the admin panel or from cron, at most once a day, never while customers browse or check out.
Add a released add-on to this order and save 15% on it. It uses the same edition and store domain.
Order Source & UTM AttributionThis add-on
+
Ecommerce Tracking ProEvery ecommerce event for Google Analytics 4, via gtag.js or Tag Manager, with AJAX cart tracking, Consent Mode v2 and server-side purchases.
