Visit path

The visit path records the pages a visitor looked at before they left their details. Each submission can carry a short list of the pages they viewed, so you can see how someone arrived at the form. It is off by default and only collected with consent.

Turning it on

Go to OctaForms → Settings → Privacy & security and tick Record the visit path. It is off on a fresh install and stays off after an update until you turn it on.

Two things must be true before a path is actually saved:

1. You turned collection on in the setting above.
2. The visitor allowed statistics. The plugin has no cookie banner of its own. It reads the consent signal from whatever consent system your site already uses (see Consent below). With no consent system on the page, nothing is collected by default.

If your pages are cached, a change to the setting takes effect on those pages only after the cache is cleared.

What is recorded

For each page the visitor viewed, one entry is stored:

"user_path": [
  { "t": "2026-07-11T10:20:30.000Z", "path": "/" },
  { "t": "2026-07-11T10:21:05.000Z", "path": "/pricing" },
  { "t": "2026-07-11T10:22:40.000Z", "path": "/contact" }
]

• t is the time the page was viewed, in UTC.
• path is only the page path. No query string and no domain are stored, so campaign parameters (UTM, gclid), search terms and tokens in the address are never captured. This is deliberate data minimisation.

Up to 50 pages are kept per visitor (the oldest drops off first). Pages viewed more than 30 days ago are dropped, on the visitor’s device and again on your server. After a form is sent successfully the path starts over, so the next submission from the same device does not repeat it.

Consent

Collection only happens with consent for analytics/statistics. The plugin looks for a signal in this order and the first level that has an opinion decides. An explicit “no” at a higher level is final and is never overridden by a lower one.

1. Your own hook. If you define window.octaFormsConsent.canTrack() returning a boolean, that is the final word.
2. Google Consent Mode v2. If your consent tool emits Consent Mode (most do, including CookieYes, Cookiebot, Complianz, Real Cookie Banner via the standard), the plugin reads analytics_storage. A default of denied means “not yet”: nothing is collected, but nothing stored earlier is cleared either, because many consent tools send the visitor’s answer a moment later. Only an update to denied counts as a refusal. When the page’s dataLayer holds no consent entries, the plugin reads the state Google’s tag keeps for itself (window.google_tag_data), with the same rules. The first page is recorded only once the page has loaded, so a consent default placed further down the page is read too.
3. WP Consent API. If a plugin implements it, the statistics category is read.
4. No signal at all. By default nothing is collected. A developer can opt into collecting without a consent system (see below).

When a visitor declines, or later withdraws consent, the stored history is cleared from their device.

Collecting without a consent system

If you have no consent system and accept the responsibility yourself, set requireConsent to false:

add_filter( 'octa_forms_user_path_require_consent', '__return_false' );

Until you do, a site with no consent banner records nothing. That is intentional and ePrivacy-friendly, so if you turn the feature on and “nothing happens”, this is usually why.

Where it shows up

• Single submission page (admin). A dedicated Visit path section lists the times and pages, next to the deliveries. Each page is a link, so you can open what the visitor saw.
• Webhooks. Off by default, opt in per webhook — see Webhooks.
• Personal data export. Always included (it is the person’s data) as a JSON string.
• Emails and the submissions list CSV. Not included.

To see where the visitor came from and which campaign brought them, turn on the lead source as well. The visit path deliberately leaves out the address’s query string, so it never holds campaign tags.

Your own JavaScript

If you submit forms with your own script instead of the helper, the visit path rides along as meta.user_path on the submission payload. You can also add your own data to meta from a separate module without touching the helper:

window.octaForms.addMetaProvider( () => ( { source: 'newsletter' } ) );

Each provider returns a plain object merged into meta. A provider that throws is skipped and the submission still goes out; the reserved keys url and context always win over a provider.

Filters

Filter	Purpose
octa_forms_user_path_enabled	Force collection on or off in code (default: the setting).
octa_forms_user_path_require_consent	Whether a consent signal is required (default: true).
octa_forms_user_path_limits	The { maxEntries, ttlDays, maxEntryChars } limits (one source of truth for the front and the server).