This page explains what a lead is, how a form submission becomes one, and how to switch lead
capture on. It also covers the parts that decide whether capture actually works: your plan, the
consent mode, your caching/WAF setup, and which form plugin you use.

Note Lead capture is a paid feature. It requires the Starter or Pro plan and the
Enable lead tracking toggle on the Privacy page. On the free plan the toggle is visible but
locked. (Starter)

What a lead is

A lead is a stored record of a single form submission, combining:

• Contact details read from the submitted form — email, name, and phone. SmartDingo detects
  these automatically from each field’s type and name attributes (it also recognizes common
  Dutch names such as naam, telefoon, e-mail). Every other non-empty field is kept as extra
  context.
• Tracking data already stored in the visitor’s browser — UTM parameters, first-touch UTM,
  ad click IDs, landing page, referrer category, device type, and the other fields you enabled.
• Form context — the matched form configuration name, the page path it was submitted on, and a
  visitor ID used for de-duplication.

SmartDingo does not create or store the submission itself — your form plugin still sends the
email or saves the entry as usual. A lead is a parallel copy enriched with the marketing data,
shown on SmartDingo Form Tracker → Leads. See Managing leads.

Note A submission is only captured if the form matches one of your form configurations —
i.e. at least one mapped CSS selector exists on that form. A form with no matching configuration
is filled with nothing and logged as nothing. See
Field mapping & auto-fill.

How a submission becomes a lead

When lead tracking is active, the tracker script runs a five-step flow on the front end:

1. Waits for a real success event. For a supported form plugin it listens for that plugin’s own
   “submission succeeded” event (for example CF7’s wpcf7mailsent, Gravity Forms’
   gform_confirmation_loaded, WPForms’ wpformsAjaxSubmitSuccess). This fires after the form
   validates, so failed validations don’t create false leads.
2. Reads the form immediately. Contact and tracking data are captured synchronously, because
   some plugins reset or remove the form milliseconds after the success event.
3. Fetches a fresh security token from an uncached admin endpoint (see the next section).
4. Sends the lead to WordPress using navigator.sendBeacon where available (it survives the
   page navigation that redirect-style forms trigger), falling back to a normal request.
5. Server validates and stores. WordPress checks the nonce, one-time token, origin, a honeypot,
   and a per-IP rate limit, then writes the lead row and returns its ID.

Why lead capture survives page caching

The lead submission is authenticated by a WordPress nonce and a one-time HMAC token that is
valid for only 5 minutes. Both are normally printed into the page HTML at load time.

On a full-page-cached site (LiteSpeed, WP Rocket, WP Super Cache, Cloudflare, host cache) that
HTML — including the token — is frozen for the lifetime of the cache, often hours or days. By the
time a visitor submits, the inline token is almost always expired, and the server would reject the
lead.

To avoid this, the tracker mints a fresh token right before submitting by calling the
admin-ajax.php action sdft_lead_token, which is never full-page cached and sends
no-cache headers. This is why lead capture works behind aggressive caching and CDNs without any
per-host cache rule — the frozen inline token is simply replaced with a live one.

Warning Lead capture depends on two admin-ajax.php actions reaching WordPress:
sdft_lead_token (mint a token) and sdft_log_lead (store the lead). If a caching plugin caches
admin-ajax.php, or a WAF/firewall blocks POST requests to it, no leads will be stored. Never
cache or block admin-ajax.php. After deploying or changing settings, purge every cache so
visitors load the current tracker script — see
Before you go live.

How consent affects capture

Lead capture obeys the same consent mode as tracking (Privacy page). If a consent mode is set
and consent has not been granted, the tracker skips capture entirely — even the redirect
safety-net beacon below respects consent. In practice:

• Off — leads are captured immediately, with no consent check.
• WP Consent API / Manual — leads are captured only once consent is granted.

GDPR A lead combines a person’s contact details with their tracking data, so it is personal
data. Choose your consent mode deliberately, especially in the EU/UK. See
GDPR & consent.

Reliable vs. best-effort capture

Not every form can be captured with the same certainty.

Reliable capture is available for the supported AJAX form plugins: Contact Form 7,
Gravity Forms, WPForms, Fluent Forms, Elementor Pro, WS Form, Formidable Forms, Ninja Forms.

Best-effort paths fire before the server finishes validating, so a submission that the form
plugin later rejects (spam, server-side validation) can still produce a lead. To make these
distinguishable, the redirect safety-net beacon tags its leads with capture_method = beacon-best-effort in the tracking data. All other captures are tagged ajax — this covers both
validated success-event captures and the best-effort fallback used for unknown forms, so the
ajax tag on its own doesn’t guarantee a validated submission. Combine it with knowing which form
plugin the lead came from. See
Supported form plugins.

Note Auto-fill works with virtually any form that has mappable fields, but lead capture is
reliable for the supported AJAX form plugins listed above; redirect-style confirmations and
unknown forms are captured on a best-effort basis.

De-duplication

A visitor who double-clicks submit, or whose form triggers its success event more than once,
should not create duplicate leads. SmartDingo de-duplicates in two places, both using a
30-second window keyed on the visitor ID, the form page, and the form name:

• In the browser — a repeat submission within 30 seconds is not sent.
• On the server — if a matching lead already exists within 30 seconds, the submission is
  accepted as a no-op (duplicate_skipped) and nothing new is stored.

A genuine second submission after the 30-second window is logged normally.

Enable lead capture — checklist

1. Confirm your Starter or Pro license shows as active.
2. Go to the Privacy page and tick Enable lead tracking, then save.
3. Make sure the form you want to track has a form configuration whose selectors exist on it
   (a form with no matching mapping is not logged).
4. Set a consent mode that matches your legal setup — and remember capture waits for consent
   unless the mode is Off.
5. Make sure admin-ajax.php is not cached or blocked by your caching plugin, CDN, or WAF.
6. Purge all caches so visitors load the current tracker script.
7. Do one test submission with a recognizable UTM (e.g. ?utm_source=sdft-test) and confirm the
   lead appears on the Leads page. Delete the test lead afterward.

Next steps

• Managing leads
• Supported form plugins
• GDPR & consent
• Before you go live