We Audited 100 Outbid Sites. Only 11 Retained the Same Stored UTM Value

Outbid.lol turned a brilliantly simple idea into a viral business: pay more, rank higher, and buy attention in public. X summarized the launch as nearly $100,000 in two days, and creator Jonathan Wilke later reported $132,000 in revenue, about 1.1 million visitors, and more than 190,000 product-link clicks.

But every buyer faces a less exciting question: Can the website receiving that attention prove whether the investment created a lead, sale, or customer?

We audited the top 100 Outbid entries twice. The HTTP scan found 97 destinations preserving a tagged URL somewhere in the flow. The more revealing browser test found that 31 of 100 stored at least one UTM-bearing value after landing, but only 11 retained an exact storage key/value after the tested follow-up navigation. Ten of those 11 retained a value containing the original landing marker.

Learn why this happens

What happened with Outbid.lol?

Outbid is a public pay-to-rank leaderboard. A founder submits a product, website, app, or social profile and bids for placement. Higher bids rise above lower bids. The mechanism is simple, visible, competitive, and extremely shareable.

That simplicity created remarkable momentum. The X trend page described Outbid as a bare-bones side project that quickly reached roughly 1.1 million visitors, a $14,013 top bid, and hundreds of listings. In a public update, Wilke self-reported:

• about 1.1 million visitors
• a $14,013 number-one bid
• $132,000 in revenue
• 867 products added
• more than 190,000 product-link clicks

Those are creator-reported launch figures, not figures independently audited by us. They are still enough to explain why businesses rushed to buy a spot.

The marketplace made the cost and the clicks visible. It did not automatically make the buyer's conversions visible. That is where our investigation began.

We ran two different audits

We captured the top 100 entries shown on Outbid on August 22, 2026, covering ranks 1 through 50 on page one and ranks 51 through 100 on page two.

The first audit used HTTP requests to inspect redirects, HTML, response cookies, tracker signatures, static storage references, and URL preservation. The second audit used an isolated Chromium browser context for each entry to inspect actual cookie, local-storage, and session-storage values after JavaScript had time to run.

The HTTP audit asked whether tracking ingredients were visible. The browser audit asked whether the controlled UTM values were actually written into browser storage and observed again after navigation.

Browser UTM persistence results

The client-side script waited 2.5 seconds after the landing page loaded, searched cookies, localStorage, and sessionStorage for UTM keys or UTM-bearing values, and then attempted a follow-up same-origin navigation.

There are three useful denominators:

• 31% of all 100 entries stored a UTM-bearing value after the landing wait.
• 11% of all 100 entries retained an exact stored key/value after the scripted follow-up navigation.
• 11 of the 24 storage-positive entries with a testable follow-up, or 45.8%, retained an exact match.

That last percentage should not be turned into a general benchmark. The storage-positive subset was small, and the test did not complete a real lead or purchase.

Important limits of the browser persistence test

The browser pass is much closer to a real user journey than an HTTP request, but the script still has boundaries that matter.

1. The follow-up URL was tagged again with the same utm_source, utm_medium, and utm_campaign, while utm_content changed from a landing marker to an inner-page marker. This verifies storage consistency under two tagged visits. It does not perfectly reproduce an untagged internal click.
2. Some discovered follow-up links resolved to a same-page hash or another URL shape rather than a clearly different content route.
3. A matching generic source, medium, or campaign value could be rewritten during the second navigation. The ten matches containing the original landing marker are stronger first-touch evidence.
4. The script used a new isolated context per entry, blocked service workers, and used a custom audit user agent. Bot defenses or user-agent rules may change site behavior.
5. The script did not interact with consent banners. Consent-gated storage may therefore appear missing.
6. It did not submit forms, create orders, inspect webhooks, or verify CRM mappings.
7. It inspected browser storage after a 2.5 second wait. Slower implementations may not have completed.

The next stricter version of this test should navigate to a clean inner URL with no UTMs at all, preserve the same browser context, submit a controlled form, and verify the source in the raw request and CRM record.

HTTP and technology results

The earlier server-side pass remains useful because it explains the infrastructure around the browser findings.

The most common recognized technologies were:

Other signatures included LinkedIn Insight, Plausible, Hotjar, FullStory, Umami, Fathom, Amplitude, RudderStack, Matomo, Simple Analytics, and Sentry.

This is not a list of 70 winners and 30 failures. It is a map of visible implementation evidence. A tag can be present and broken. A cookie can be absent from an HTTP response and still be written by JavaScript. A privacy-aware site may intentionally suppress storage before consent.

How the HTTP audit worked

For each ranked entry, the audit attempted to test:

1. The destination origin's homepage.
2. The exact URL listed on Outbid.
3. The first discoverable same-origin, non-authenticated inner page.

We appended a controlled campaign signature:

utm_source=outbid_audit&utm_medium=referral&utm_campaign=top100_tracking_audit

A per-page utm_content value distinguished the homepage, ranked URL, and inner-page tests. The scanner followed up to eight HTTP redirects and recorded:

• final URLs and status codes
• response Set-Cookie headers
• cookie names and attributes
• known tracker signatures in HTML and redirect responses
• static references to localStorage and sessionStorage
• whether UTM parameters survived each observed URL path

This first pass did not inspect a person's existing browser profile, read live browser storage values, accept or reject every consent banner, complete every signup or checkout, or inspect every site's CRM. That is why we added the separate Chromium audit.

What does Set-Cookie actually mean?

The HTTP Set-Cookie response header tells a user agent to store a cookie and return it in later qualifying requests. MDN's Set-Cookie reference explains that Expires and Max-Age can define how long the cookie should remain available.

That makes Set-Cookie useful evidence of server-issued state. It does not identify the cookie's business purpose.

The response cookies in our scan included examples consistent with:

• security and bot protection
• anonymous visitor or session IDs
• localization and currency
• consent region
• application sessions
• feature flags and experiments
• analytics identity
• affiliate or campaign attribution

Only a small subset had names that obviously suggested UTM or attribution storage. Other cookies may use opaque names, and client-side analytics cookies are often absent from the original HTML response.

Why 31 is not the same as 31 sticky attribution cookies

The user's original observation is directionally important, but a Set-Cookie header alone is not enough to call a cookie sticky.

• A session cookie can disappear when the browser session ends.
• A persistent cookie normally includes Expires or Max-Age.
• A persistent cookie may store language, security, or product state rather than attribution.
• A browser can reject or partition a cookie based on domain, path, SameSite, Secure, consent, or privacy behavior.
• A cookie can be overwritten before the person converts.

In this audit, 22 of the 100 entries returned at least one cookie with an observed Expires or Max-Age attribute. Even that stronger persistence signal does not prove that the site saved Outbid attribution.

Why a site can track without a server Set-Cookie response

There are several legitimate reasons an HTTP audit may not see a response cookie.

1. JavaScript can create the cookie

The browser's document.cookie API lets client-side JavaScript write a cookie after the page loads. That cookie will not necessarily appear in the original document response.

2. Local storage can preserve attribution

The Web Storage API provides localStorage and sessionStorage. Google's own Conversion Linker documentation says click information can be stored in first-party cookies and browser local storage.

Our static scan found storage API references on 45 entries. That is evidence of code capability, not proof that UTM data was written.

3. Consent can delay or prevent storage

Google documents that consent-aware tags can avoid storing cookies when storage consent is denied and may send limited cookieless signals instead. A site that waits for consent can look empty in a non-interactive HTTP scan while behaving correctly in a consenting browser session.

4. Server-side measurement may not need browser storage

A site can log a request, session, lead, order, or referral on its server. GA4 also notes that its libraries can transmit data without requiring the site to set a cookie, although cookies normally help distinguish users and sessions.

No response cookie does not equal no measurement. It means the server did not issue a visible cookie during the requests we tested.

Why finding GTM, GA4, Meta Pixel, or PostHog is still not proof

A recognized tracker answers only the first question: Is measurement code visible?

It does not answer:

• Did the tag load after consent?
• Did the page-view event contain the correct URL and referrer?
• Did the conversion event fire on the actual form, purchase, or booking?
• Was the event duplicated?
• Was the event value or transaction ID correct?
• Did the original Outbid source survive a later visit?
• Did the form payload carry the source?
• Did the CRM map it to dedicated fields?
• Can revenue be grouped by that source?

Google's Google Ads conversion-tag documentation requires a conversion ID, conversion label, trigger, and appropriate values. Merely detecting a GTM container cannot verify any of those details.

Installed is not implemented. Implemented is not validated. Validated traffic is not revenue attribution.

UTM preservation was surprisingly strong, but incomplete

UTM query parameters survived at least one observed response for 97 of the 100 entries. That is good news. Most tested destinations did not immediately erase the campaign signature from every request path.

However, six entries had at least one path where the UTM parameters did not survive. These cases included redirects, third-party destinations, social profiles, app-store pages, and destination changes.

Google recommends using relevant manual campaign parameters, especially utm_source, utm_medium, and utm_campaign, to populate traffic-source dimensions. But a UTM sitting in the address bar is only an opportunity to capture attribution.

To measure investment, the site must turn the URL into durable business data:

Outbid click -> Tagged landing URL -> First-party persistence -> Form or checkout payload -> CRM or order record -> Revenue report

If any arrow breaks, the company may know that traffic arrived without knowing what it produced.

Can these 100 sites actually measure their Outbid investment?

The audit cannot honestly answer yes or no for every site. It can answer a more useful question: how much evidence was visible before completing a real conversion journey?

The evidence was mixed:

• 97 accepted a tagged URL somewhere in the tested flow. This is a strong starting point.
• 70 exposed a recognized tracker on an owned destination. Many had analytics infrastructure.
• 45 referenced browser storage APIs. Some may persist identity or attribution client-side.
• 31 actually stored a UTM-bearing value after the browser landing wait. The second audit moved from static capability to observed client-side behavior.
• Only 11 retained an exact storage key/value after the tested follow-up navigation. Ten retained a value containing the original landing marker.
• 31 returned server-issued cookies. Server response state was visible on less than one-third of entries.
• 22 returned an explicitly persistent cookie. Fewer exposed persistence through response attributes.
• Only a handful of visible cookie names clearly described attribution. Most response cookies could not be classified as campaign storage from their names alone.

The uncomfortable conclusion is not that 89 sites are incapable of tracking. It is this:

For most entries, even the browser audit could not demonstrate a stable UTM storage value through the tested follow-up navigation, much less an end-to-end path from Outbid click to lead, customer, and revenue.

That proof requires a conversion test, not merely a tag scan, cookie scan, or browser-storage scan.

The six layers of reliable Outbid attribution

Layer 1: Tag the destination link

Use a complete and consistent campaign URL. For example:

https://example.com/offer/?utm_source=outbid.lol&utm_medium=paid_referral&utm_campaign=outbid_leaderboard&utm_content=rank_01&utm_id=outbid_2026_08

Use a stable campaign ID and update utm_content when you change the listing, creative, destination, or placement strategy.

Layer 2: Capture the parameters immediately

Read the UTMs on the first page before a redirect, cache rule, hydration delay, consent callback, or navigation can change the URL. Preserve the raw landing page and original referrer too.

Layer 3: Store first touch and latest touch separately

An Outbid visitor may browse today and return next week through branded search. Store:

• original source
• original medium
• original campaign
• first landing page
• first referrer
• latest source
• latest campaign
• conversion page

Overwriting the original Outbid click with the final direct or branded visit makes the investment invisible.

Layer 4: Put attribution into the conversion payload

The attribution must be included in the actual business object:

• form submission
• trial signup
• booked meeting
• checkout order
• subscription
• application
• phone or email lead

For a form, inspect the raw request and confirm the hidden fields are populated. For a checkout, inspect the order metadata, webhook, and payment record.

Layer 5: Map the fields into the CRM or order system

A perfect browser cookie is useless when the integration drops the values. Verify every hop:

Form -> Webhook or automation -> CRM contact -> Opportunity -> Closed revenue

Keep source fields separate from notes. A structured field can be grouped, filtered, and joined to revenue.

Layer 6: Calculate business ROI

The useful report is not only Outbid sessions or clicks. It includes:

• listing cost
• Outbid clicks
• website sessions
• identified leads
• qualified leads
• purchases or closed deals
• revenue
• cost per lead
• cost per qualified lead
• customer acquisition cost
• revenue per click
• return on ad spend
• assisted conversion value

A public click counter measures attention. Your own attribution system must measure economics.

A 15-minute Outbid conversion tracking test

Run this before bidding more money.

1. Create a unique URL with utm_source=outbid.lol, a stable campaign ID, and a unique utm_content value.
2. Open a clean browser profile and click the exact destination link.
3. Confirm the final browser URL still contains the intended parameters after redirects.
4. Check the browser's cookies and local storage before and after any consent choice.
5. Navigate to at least two additional pages.
6. Reload the page and confirm the original source remains available.
7. Close and reopen the browser when your consent and privacy rules permit persistent storage.
8. Submit the real form, signup, booking, or checkout with test data.
9. Inspect the raw form payload or order metadata.
10. Confirm the CRM or order record contains the same campaign values.
11. Confirm first touch and latest touch are not overwriting each other.
12. Verify the analytics conversion event fires once with the right value and ID.
13. Confirm the test record appears in the report used to calculate revenue and acquisition cost.
14. Repeat on Safari, Chrome, mobile, and a consent-denied path where relevant.
15. Document exactly where the source disappears if any step fails.

If the source is present in GA4 but absent in the CRM, the implementation is not complete. If it is present in the CRM but cannot be joined to revenue, the measurement model is not complete.

Common reasons Outbid attribution will disappear

Redirects strip the query string

A destination shortener, canonical redirect, language redirect, or application route removes the UTMs before the tracking code reads them.

The site stores only session-level source

The source vanishes when the session ends, even though the buying journey lasts days or weeks.

Consent logic runs in the wrong order

The tracking script reads the URL too late, never receives the consent update, or stores data before the site's policy permits it.

The form has no attribution fields

Analytics records the session, but the lead submission has no UTM, click ID, landing page, or referrer fields.

An iframe blocks the parent-page context

A third-party booking or form iframe cannot automatically read the parent's cookies or URL. The data must be passed through query parameters, postMessage(), or a controlled server-side handoff.

The funnel crosses domains

Landing pages, forms, booking tools, and checkouts run on different domains without deliberate cross-domain attribution.

CRM mapping is incomplete

The source reaches the form but disappears in Zapier, Make, a webhook, native integration, contact merge, or opportunity creation.

Last-touch logic erases the Outbid discovery

A later direct visit, Google search, or email click overwrites the original paid-referral source.

For the full diagnostic process, use The Complete Tracking Failure Audit.

What good Outbid tracking looks like

How UTM Grabber closes the gap

HandL UTM Grabber is designed for the part a leaderboard click counter and a basic analytics tag cannot finish: preserving campaign context through the real customer journey.

On WordPress, UTM Grabber can capture UTMs, click IDs, landing-page data, original referrer, first-touch values, and latest-touch values in first-party cookies. Those values can then populate hidden fields in forms and travel into CRM, webhook, booking, checkout, and reporting workflows.

This matters for Outbid because the visitor may not convert on the first page or first session. A durable attribution record lets the business answer:

• Which listing campaign created the lead?
• Which landing page converted best?
• Did Outbid introduce the customer before a later branded search?
• Which Outbid leads became qualified opportunities?
• How much revenue can be traced to the campaign?

Read the first-touch and last-touch attribution documentation and audit the common tracking failure points before increasing spend.

Frequently asked questions

What does the 11 out of 100 result mean?

Under the browser script's definition, 11 entries had at least one UTM-bearing storage key/value after landing and the exact same key/value after the follow-up navigation. Ten of the 11 retained a value containing the original landing marker. This is evidence of storage continuity, not proof of form, CRM, purchase, or revenue attribution.

Did only 31 of 100 Outbid sites store UTMs?

The browser test observed UTM-bearing data in cookies, local storage, or session storage for 31 entries after a 2.5 second wait. Consent-gated logic, slower scripts, server-side storage, bot defenses, and unrecognized data formats can create false negatives, so the result should be read as observed evidence under the test conditions.

Does no Set-Cookie header mean a website has no tracking?

No. A site may set cookies with JavaScript, use local storage, wait for consent, send cookieless measurements, or record events server-side. It means only that the tested responses did not return a visible Set-Cookie header.

Does a Set-Cookie header mean UTM attribution works?

No. The cookie may be used for security, localization, sessions, consent, experiments, or another purpose. Confirm that campaign values survive navigation and appear in the conversion payload, CRM, and revenue report.

What makes a cookie persistent or sticky?

A cookie with Expires or Max-Age can persist beyond a default browser session, subject to browser policy, consent, deletion, and cookie attributes. Persistence alone does not make it an attribution cookie.

Is Google Tag Manager enough to measure an Outbid campaign?

No. GTM is a container. You still need the right tags, triggers, consent behavior, conversion definitions, values, IDs, UTM capture, form fields, CRM mappings, and QA.

What UTM parameters should an Outbid link use?

At minimum use consistent values for utm_source, utm_medium, and utm_campaign. Add utm_id for a stable campaign identifier and utm_content to distinguish rank, destination, message, or listing variation.

Can Outbid clicks be connected to sales?

Yes, when the tagged source is captured on arrival, persisted appropriately, submitted with the conversion, mapped into the CRM or order record, and joined to revenue. The click counter alone cannot do this.

Why did some audit entries lose UTMs?

Observed causes included redirects, destination changes, social-profile links, app-store links, and third-party platforms. A controlled browser test is needed to identify the exact loss point for each funnel.

The final lesson from the Outbid top 100

Outbid proved that a simple product can create an enormous attention market in days. It also created a perfect test of a broader marketing problem.

Businesses are often willing to spend immediately when a channel becomes exciting. Their measurement infrastructure moves more slowly.

The shocking result is that 97 destinations could preserve a tagged URL somewhere in the HTTP flow, yet only 31 showed UTM-bearing browser storage and only 11 retained an exact stored value after the scripted follow-up navigation. The signal shrank at every step before we even reached a form, CRM, or sale.

Before you buy more visibility, make sure your website can preserve the source, attach it to the lead or purchase, and carry it into revenue. Otherwise you may know exactly what you paid and still have no defensible answer for what you received.

Sources checked

Original research for this article includes the August 22, 2026 Outbid top-100 HTTP audit and isolated Chromium UTM-storage audit described above.

• Outbid.lol live leaderboard
• X trend: Outbid.lol leaderboard revenue and launch activity
• Jonathan Wilke: public Outbid launch metrics
• MDN: Set-Cookie response header
• MDN: document.cookie API
• MDN: Web Storage API
• Google Analytics: data collection and first-party identifiers
• Google Analytics: traffic-source dimensions and manual UTM tagging
• Google Tag Manager: Conversion Linker
• Google Tag Manager: Google Ads conversion tags
• Google for Developers: Consent Mode overview
• UTM Grabber: first-touch and last-touch attribution