How source is recorded
Source answers one narrow question: which named place did this visit come from? Values look like google, facebook.com, bing or newsletter. It is always read together with medium, which says what type of traffic it was, and the pair is what analytics uses to file a visit into a channel group.
Analytics fills the value in a set order. A tagged link wins first: if the URL carries a utm_source parameter, that is what gets recorded. Failing that, an auto-tagged ad click identifier from Google Ads supplies it. Failing that, the browser’s referrer header names the site the visitor came from. When none of those exist — a typed address, a bookmark, a link opened from a messaging app or a PDF — there is nothing to record, and the visit is filed as direct.
Why source matters
Almost every report you care about is built on it. Channel groupings, conversion reports by channel and any comparison of what different marketing activity produced all rest on source and medium being recorded correctly. Get them wrong and every downstream number inherits the error, usually without anyone noticing, because a wrong value still looks like a real one.
It matters most where spend is involved. If a paid campaign is untagged, its visits arrive looking organic, which flatters SEO and makes the campaign appear worthless. Decisions then get made on numbers that were never describing what people thought they were describing.
Where source goes wrong
Missing tags on anything that is not a Google Ads click cause most of the damage: social posts, email newsletters, WhatsApp broadcasts, QR codes on printed material, partner links and influencer posts all need tagging by hand, and each one that is missed lands in referral or direct.
Self-referral is the classic technical fault, where your own domain appears as its own source because a visitor passed through a payment gateway or a separate subdomain and came back without the original data intact. Inconsistent values cause quieter harm: Facebook, facebook and facebook.com are three different sources in a report even though they are one platform. Tagging your own internal links is a genuine mistake too, because it restarts the visit and overwrites where the person actually came from.
How to get it right
Agree a naming convention once — lower case, the platform’s plain name, no spaces — write it down, and build every campaign link from the same place so nobody invents a new spelling under deadline. A UTM builder makes that discipline easy to keep.
Leave auto-tagging switched on for Google Ads rather than hand-tagging those links, add referral exclusions for payment gateways and any subdomain of your own, and never put tracking parameters on links between pages of your own site. Then check the source report every month for near-duplicates and unexpected values, since a broken tag is far cheaper to catch in a fortnight than in a quarter. If the setup has never been reviewed, this is standard ground in a GA4 setup.