Webflow App Guide: Track AI Leads on Webflow

What the app does

Which AI Sent shows which of your website’s visits and leads came from AI assistants such as ChatGPT, Gemini, Perplexity, Claude and Copilot, next to search, social and everything else. It also checks whether ChatGPT and Gemini recommend your business when customers ask for a business like yours.

What you need

A Webflow site you can manage, on a plan that runs custom code: a paid site plan, or an eligible Workspace plan. Webflow only runs custom code (including app scripts) on those plans.
A Which AI Sent account (the Free plan is enough to start). You create it during installation, after authorizing on Webflow’s screen. You never type in your website: it comes from Webflow. See Pricing for plans.

Install

Click Install in the Webflow Marketplace, or go to whichaisent.com/webflow/install. You go straight to Webflow’s authorization screen.
Choose the site to give access to and click Authorize App. If you click Cancel, nothing is changed.
Back on Which AI Sent, confirm the site (the list comes from your Webflow account) and create your account, or log in if you already have one.
We add our script to that site through Webflow’s Custom Code API: a fixed, versioned file (https://whichaisent.com/wf/t-1.5.0.js) with an integrity hash, so your browser refuses it if it ever changes. We never publish your site. The script goes live the next time you publish from Webflow, whenever you choose.
To get leads, choose your contact form in your dashboard (see Choose the forms we read). Until you do, the app counts visits and contact-link clicks but reads no form.

Your dashboard’s Setup page shows “Waiting for your next publish” until you’ve published, then “Live”.

Permissions we ask for

Permission	Why
Read sites	To list the sites you authorized so you can pick one, and to see when you last published (for the “Live” status)
Read and edit custom code	To register our script on the site you picked, and to remove it when you disconnect
Read forms	To show you your site’s forms in Setup so you can choose which one we read: each form’s name, the page it’s on, Webflow’s IDs for it, and its fields’ names and types. We only call Webflow’s “List forms” endpoint. We never request your form submissions.

We don’t publish, and we don’t read or change your pages, CMS items, products or settings through Webflow, and we never read your form submissions through Webflow. We keep Webflow’s access token encrypted, only so we can list your forms when you ask, remove our script when you disconnect, and notice when the app is uninstalled. It’s deleted when you disconnect. We never open or read your published pages to find forms.

Connected before November 2026? The app now also asks to read your forms. In Setup, click Get my forms from Webflow; if Webflow hasn’t given that permission yet, click Reconnect Webflow and approve on Webflow’s screen. Your data and settings stay as they are.

Choose the forms we read

The script reads only the forms you choose in your dashboard, and only the fields you pick in them. It never guesses: every other form is never read or changed, whatever it looks like.

How: open Setup → Choose the forms we read → Get my forms from Webflow. We ask Webflow’s Forms API for your site’s forms and list each one with the page it’s on. Tick the one to read, check what each field is (we suggest: Name, First name, Last name, Email, Phone, How they heard about you, or “Don’t read”) and click Save. It applies within about two minutes, with no publishing needed. You need to pick at least one Email or Phone field.

How a form is recognised on your site: by the two IDs Webflow gives it, its element ID and page ID (Webflow publishes them on the form as data-wf-element-id and data-wf-page-id). The script reads a form only when both IDs match your choice exactly, on that page, and only one form on the page carries them. A form’s name never selects it, so two forms called “Contact Form” are separate choices, and choosing one never makes the other readable. Fields are recognised by the field name you see in the list (the field’s Name setting in Webflow); a name used by two fields in one form can’t be picked. If you rebuild a form in the Designer it gets a new ID: choose it again.

Only single-line text, email and phone boxes are read (plus a dropdown or choice buttons you picked as “How they heard about you”), and only when the value looks like what it claims to be (an email address, a phone number of 7 to 15 digits, a name of up to 80 characters without “@”). Message boxes, hidden fields and anything you didn’t pick are never read.

Sign-in and account forms are never read, even if chosen. This safety rule can’t be switched off. Before anything in a chosen form is read, and every time, the script checks the form and skips it entirely (it reads, sends and changes nothing in it) when:

any field is, or is shown to visitors as, a password, username, sign-in, verification-code or payment field (for example a box labelled “One-time code” or “Card number”, or with an autocomplete value such as username, one-time-code or cc-number);
it is a Webflow user-account form (log in, sign up, reset or update password, account);
its name, heading, button, labels or messages speak of signing in or up, logging in, sign-in or magic links, registering, accounts, passwords or verification codes (for example a “Sign in” heading or a “Send sign-in link” button);
it has fewer than two boxes a visitor types into: an email or phone box on its own is how sign-in links and codes are requested, and how newsletters are joined;
it is a search box.

The same rules decide which forms Setup lets you tick: a form with a password field, sign-in wording in its or its fields’ names, or only one field is shown as “Can’t be read”.

What the script does on your published site

The script is a single static file (https://whichaisent.com/wf/t-1.5.0.js), written only for Webflow sites. It doesn’t load any other code, and it doesn’t replace or wrap any of the browser’s own functions. Every Webflow site runs this exact reviewed version; a new version is a new file, reviewed by Webflow before we use it.

Before anything else it loads your site’s settings (whether you require cookie consent, whether the optional question is on, which forms and fields you chose, and whether you’ve stopped tracking). That one request carries your site key and nothing about the visitor, and its answer is never stored in the browser. Nothing else happens until consent allows it (see Cookie consent below).

For each visit it then records:

a random visitor ID, kept in a first-party cookie (_ta_vid, 90 days) and in the browser’s local storage (_ta), and a random visit ID;
the referring website (its address only, never the full link);
each page viewed: its path and title, never anything after “?” or “#”;
campaign tags if the link had them (utm_source, utm_medium, utm_campaign) and whether an ad click ID such as gclid was present (never its value);
phone or computer, and how long the visitor was active on the site;
clicks on phone, email, WhatsApp, text and booking links (which kind of link, and on which page).

What is kept in the visitor’s browser: the _ta_vid cookie (the visitor ID, 90 days, first-party) and the _ta entry in local storage, which holds only the visitor ID, the visit ID, the time of the last page view, and the referring site and campaign tags of the current visit, with the names of any ad click IDs that were present (such as “gclid”), never their values. It is used to tell when a new visit starts. After 90 days without a visit it is not reused: the next visit starts with a new visitor ID. Anything an earlier version stored there is replaced with just these fields on the next visit. The only other entry is _ta_optout, and only in your own browser if you use “Don’t count my visits” (below). Nothing is stored before consent allows it. All of it is deleted at once when a visitor withdraws consent, and on the visitor’s next page view after you stop tracking.

When a visitor sends a form you chose, it sends the fields you picked (their name, email address and phone number, and the “How did you hear about us?” answer if there is one), so the lead can be matched to the visit.

What it changes on your site: nothing, unless you turn on the optional question below. It never adds hidden fields or changes links.

Cookie consent: the script decides about consent before it creates or sends anything. It follows your site’s own command, (window.whichaisentQ = window.whichaisentQ || []).push(['consent', true]) or false (your latest command counts, even if it arrives while the settings are still loading), and these consent banners: Finsweet Cookie Consent, Cookiebot, CookieYes, OneTrust, Complianz and Google consent mode. A “no” from either always wins. If you turn on Settings → Cookie consent (or our settings can’t be loaded), nothing is stored or sent until the visitor accepts analytics cookies (a “yes” from your command or the banner, and no “no” from the other). Without that setting it runs unless there is a “no”. Browsers that send Global Privacy Control are never measured.

When consent is withdrawn the script stops for good on that page, at once: before reading anything else it removes all its listeners and its page observer, removes the question it added, deletes its cookie and local storage, and from then on reads, sends, stores and changes nothing. Measuring only starts again on a later page, if the visitor consents again. It stores no IP addresses and sets no advertising cookies. Full details: Data & tracking.

Optional, off unless you turn it on: a “How did you first hear about us?” dropdown added to the forms you chose (never to any other form, and not when you picked your own “how did you hear” field). This changes what visitors see on those forms. It’s optional for them to answer and you can switch it off any time in Setup or Settings.

Your own visits: the “Don’t count my visits” link in your dashboard opens your site with ?was_ignore=1; that browser is then skipped on your site (it stores _ta_optout and deletes the other entries). ?was_ignore=0 undoes it.

Check it’s working

After you’ve published, open Setup and click Open my website as a ChatGPT visitor. Your site opens in a new tab as if someone clicked through from ChatGPT; within a few seconds the dashboard shows “It works!”. If your site has a cookie banner, accept analytics cookies in that tab first. Test visits are never counted and store nothing in the browser.

To check your forms, use Setup → Get my forms from Webflow to see what you chose, then send your chosen form once yourself: the lead appears under Leads.

You can also see the script in Webflow: Site settings → Custom code → Code added by Apps → Which AI Sent.

Using the dashboard

Home: AI revenue, bookings and leads, and the share of your organic traffic that came from AI.
Leads: every form lead with where the person came from, the pages they viewed, and a pipeline stage and value you can update.
Visitors: visits by source, day by day.
AI visibility: the answers ChatGPT gives when customers ask for a business like yours, whether you’re named, and who is named instead.
Integrations: send each lead to your CRM or any tool that accepts a webhook.

Remove the app

From Which AI Sent: Setup → Stop tracking this website → Disconnect. At that moment we remove our script from your site’s custom code through the Custom Code API, delete Webflow’s access token, and stop accepting data from your site. When it leaves your live site: Webflow serves your published site as it was last published, so the script file stays on your live pages until your next publish. Until then it does nothing: it loads only your settings, sees that tracking is stopped, deletes its cookie and local storage, and reads, sends and changes nothing. Publish once and it’s gone.

From Webflow (uninstalling the app): Webflow ends our access. Within 24 hours our daily check notices, and from then on the script does nothing (as above) and we accept no data from your site. We can no longer change your site at that point, so to take the script off your pages yourself: Site settings → Custom code → Code added by Apps, delete Which AI Sent, then publish.

If you pasted our code by hand in the past (before the app, or from an older guide): open Site settings → Custom code → Head code, delete the line containing whichaisent.com, save and publish.

To delete your data as well, email info@whichaisent.com.

Troubleshooting

Setup says “Waiting for your next publish”: publish your site from Webflow. The app doesn’t publish for you.
“We haven’t seen the visit yet”: check you’ve published since connecting, and accept the cookie banner if your site has one, then run the test again.
The test never arrives in one browser: browsers that send Global Privacy Control (for example Brave, or Firefox with that setting on) are never measured, by design. Run the test in Chrome, Safari or Edge.
Visits are counted but no leads arrive: choose your contact form and its fields (see Choose the forms we read). If you rebuilt the form or renamed its fields in Webflow since, choose again. A form that looks like a sign-in, sign-up or verification form, or has only one box to fill in, is never read, even when chosen.
“Webflow needs your OK” when listing forms: click Reconnect Webflow and approve on Webflow’s screen. Apps connected before November 2026 didn’t have the “Read forms” permission yet.
A site shows “already connected to an account”: that site is tracked by another Which AI Sent account. Disconnect it there first.

Support

Email info@whichaisent.com or use Need help? in the dashboard.

Which AI Sent for Webflow