Shopify Attribution: What the Reports Really Measure

What follows is the detail: what the window does to a long consideration cycle, the six reasons an order lands in direct, which model flatters which channel, and the three things no model in Shopify can reach.

Every session on your store carries a source. Shopify reads it from the URL's campaign parameters first and from the referring domain second, stores it against the visitor, and when an order is placed it decides which of the stored sessions gets the credit.

• The campaign parameters winutm_source, utm_medium and utm_campaign on the landing URL are read as they are. This is why a link without them is a guess and a link with them is a fact, and why the discipline of tagging every paid and social link is worth more on Shopify than any app you can install.
• The referrer is the fallbackWith no parameters, Shopify uses the referring domain and maps it to a channel: search, social, referral. An empty referrer is direct, and an empty referrer is far more common than most store owners assume.
• The last non-direct click, inside 30 daysThe order is credited to the most recent session that had a recognisable source, ignoring direct visits. Sessions older than 30 days are not considered, and if no order happens in that time the stored referrer is replaced by whatever comes next.
• The order is the conversionThis is the part Shopify gets right and most tools get wrong: the number in the report is an order that exists in your order list, not a browser event that fired. It is why the report is worth trusting about volume even when it is wrong about source.

A 30 day lookback is generous for an impulse purchase and short for anything a customer thinks about. If somebody sees a creator's video in March, follows you, reads two emails, and buys in May after a brand search, Shopify credits the brand search. Not because it prefers brand search, but because the video is outside the window and no longer stored.

The practical test is your own cycle. Pull the median days between first session and order for the last quarter. If that number is above about ten days, a 30 day window is already deciding a meaningful share of your credit, and the model menu is arguing over a subset of the touches that actually happened.

Direct in Shopify does not mean somebody typed your domain. It means the session arrived with no campaign parameters and no referrer that Shopify could read. Six things produce that, and all six are ordinary.

• Bio links and social posts

  A link in an Instagram bio, a TikTok profile or a Reddit comment usually carries no UTMs, and the in-app browser often strips the referrer. The traffic is real, the attribution is not there.

• AI search

  A shopper who asked ChatGPT or Perplexity for a recommendation and clicked the citation arrives with a referrer your channel rules were never written for, when it arrives at all. Most of that traffic sits in direct.

• Email and messaging clients

  Desktop mail clients, WhatsApp and Slack open links without a referrer. If the email link has no UTMs, the order is direct, and email is usually your best performing channel.

• Ad blockers and privacy settings

  Blocked scripts and restricted storage mean the stored source can be missing or truncated by the time the order is placed, especially on a return visit days later.

• Anything before your store

  A click that landed on a campaign page, a blog or a landing page on another domain is not a store session at all. Whatever brought them there is not in the report.

• Payment redirects and express checkout

  A shopper who pays through a wallet or is redirected to a provider can come back on a fresh session, and that session is the one carrying no source.

The first three are fixable this week with link discipline: put UTMs on every paid link, every bio link, every email and every affiliate placement. The last three are structural, and no amount of tagging closes them, because the source has to be recorded somewhere that survives the gap.

When a Shopify report combines a sales metric with a marketing dimension, the Attribution menu appears and the report can be switched between five models. It is worth switching, because the comparison tells you more than any single view: a channel that only looks good under last click is a closer, and one that only looks good under first click is an introducer.

Every one of the five splits credit across the touches Shopify kept, which is the real constraint. A position based model over two stored sessions is not multi-touch attribution, it is a last click model with extra arithmetic.

Three systems report on your marketing and none of them is lying. They count different objects over different windows with different models, which is why reconciling them by hand is a monthly job that never ends.

Add the platforms together and you will always have more purchases than orders, because each one counts a purchase it can claim and several can claim the same one. That is not a bug to fix in the ad accounts. It is arithmetic, and the only way out is to count the order once, from the order list, and then decide which touch gets the credit.

• Your spend, across every platformShopify sees spend where a channel app reports it. If you buy on four platforms and only two have apps in your store, the ROAS in the report is missing two of your bills, so the comparison you actually need is built in a spreadsheet.
• Which channel bought a customer, not an orderReturning customer sales are reported by cohort, not by acquiring channel. So a creator campaign that produces buyers worth five orders each is priced on the first order alone, which makes it look worse than a discount campaign that produces one purchase and silence.
• A way back to the ad platformShopify's channel apps send their own events to their own platforms. There is no single place where the paid order, with its real value and its refunds netted off, goes back to every platform you buy on. Without that, bidding keeps optimising on add to carts.

Those three are the reason attribution tools exist for a platform that already has attribution. The job is not to replace what the admin does. It is to keep the touches Shopify's window drops, to price them against all of your spend, and to hand the paid order back to the platforms so they can learn from revenue.

1. Tag every link you control. Paid, bio, email, affiliate, partner, QR code. Anything untagged is a vote for the direct bucket.
2. Measure your own consideration cycle. Median days from first session to order. If it is above ten, the 30 day window is deciding your credit.
3. Pick one model for budget decisions and write it in the same document as your targets, so nobody argues about the numbers by switching the menu.
4. Count orders, not conversions, in every review. Start every marketing meeting from the order list and treat platform conversion counts as estimates of their own contribution.
5. Record the journey where the window cannot end it, first-party and server-side, so the first touch survives a 30 day gap, a payment redirect and a blocked script.
6. Send the paid order back to every platform you buy on, with its value and with refunds netted, so bidding learns from customers instead of carts.

The first four are free and worth doing whatever else you run. The last two are what a tool is for, and they are the two that change what the platforms optimise towards rather than only what your report says.

Next to this one: Shopify conversion tracking, every method and Shopify server-side tracking. On other shop systems, WooCommerce order attribution and Shopware server-side tracking. On the product side, the Shopify integration, e-commerce attribution software and the page for e-commerce brands. On the concepts, multi-touch attribution and why GA4, Meta and Google never agree.