Affiliate tracking and postbacks explained

Tracking is the part beginners postpone and then regret. Without it you know your site had visitors and that the affiliate dashboard shows a number; you do not know which page produced the depositor, whether the click even arrived, or why the two systems disagree. Six months of that and you are optimising in the dark.

This guide takes the chain apart in order: what a tracking link is made of, what the cookie does and where it fails, what a postback is and who fires it, how to structure subIDs so your reports answer questions, and the five mistakes that reliably hide your best-performing pages. It ends with a setup checklist you can finish in half an hour.

The chain from click to commission, in six steps

1. A reader clicks your outbound link. On a well-built site that link points at your own redirect route, not straight at the operator, so you own the first log entry.
2. Your redirect logs the click — timestamp, page, country, user agent — and sends the reader on to the affiliate platform's tracking URL.
3. The affiliate platform records the click against your affiliate ID and the campaign in the URL, sets a cookie, mints a click ID, and forwards the reader to the operator's landing page.
4. The reader registers. The operator ties the new account to the click ID or the cookie, and the platform shows a signup.
5. The reader deposits. That converts the signup into a first-time depositor, which is the event most commission models actually pay on.
6. The platform calculates commission at month end from that player's net gaming revenue, applies deductions, and adds it to your balance.

Every step can drop data, and each system counts a different thing. That is why your numbers never match the program's, and why "which number is wrong" is the wrong question — they are measuring different events.

Anatomy of a tracking link: what every parameter in the URL does

A typical affiliate tracking URL looks like this (structure varies by platform, the roles do not):

https://record.examplepartners.com/_AbC12xyz/1/?subid=hub-casino-review-row3&lang=en

The parameters you control (subID) versus the ones the platform controls

You control the subID parameter and almost nothing else. Treat it as the one lever you have and never leave it empty. The platform controls the affiliate token, the campaign segment and the landing page mapping; if you need a second campaign slot for a second site, ask the affiliate manager rather than inventing a parameter — an unrecognised parameter is silently dropped, and you will not be told.

Cookies, click IDs, and why the cookie is the weakest link

Classic affiliate tracking sets a first-party or third-party cookie on the operator's domain at the moment of the click. If the reader registers before it expires, you are credited. The cookie duration is therefore a real commercial term: across the programs in our program directory, most publish no window at all; the handful that do record 30, 45 or 60 days, and two state "lifetime" — which in practice means "until another affiliate's click overwrites it". Treat an unpublished window as a question for the affiliate manager rather than as a generous one.

The cookie fails in ordinary conditions, not exotic ones: the reader clicks on a phone and registers on a laptop, uses a private window, has third-party cookies disabled, or simply waits 45 days on a 30-day window. This is why the click ID matters more every year. A click ID is a unique token minted at click time and carried forward server-side, so attribution does not depend on anything surviving in the browser. When a program offers both, wire up the click ID.

Server-to-server postbacks: what a postback is and who fires it

A server-to-server postback, also called S2S tracking, is the affiliate platform calling your server when a conversion happens, instead of relying on a pixel loading in the reader's browser. It is a plain HTTPS request to a URL you provide, with the conversion details in the query string. Nothing renders; the reader never sees it. Because it is server-to-server, an ad blocker, a browser policy or a closed tab cannot break it.

Direction matters and is the thing beginners get backwards: the platform fires the postback, you receive it. Your job is to expose an endpoint, register its URL in the platform, and store what arrives.

A worked postback URL, field by field

You register a template with macros; the platform substitutes real values at conversion time:

https://yoursite.com/api/postback?click_id={subid}&event={event_type}&player={player_id}&amount={amount}&currency={currency}&ts={timestamp}&sig={signature}

Two rules for the endpoint: verify the signature before you store anything, and reply with a 200 quickly — several platforms retry a slow or failing endpoint a fixed number of times and then give up on that conversion permanently.

SubIDs done properly: one token per site, per page, per campaign

A subID of "site1" answers no question. A structured token answers three. Use a fixed, delimited scheme and never change its shape once live:

<site>-<pagetype>-<slug>-<position> — for example hub-review-betsson-cta1 or hub-list-casino-row3.

• site — separates properties when several of your sites use one affiliate account.
• pagetype — review, list, guide, blog. Tells you which template earns.
• slug — the page itself. This is the level at which you make editorial decisions.
• position — top CTA, in-table row, footer. Reveals that most of your revenue comes from one component you barely think about.

Keep the tokens short, lowercase and free of spaces, and keep a single list of which token belongs to which link. A working affiliate ends up holding far more tracking links than are live on a page at any time, and the only thing that keeps that manageable is one canonical list rather than tokens invented per article.

Attribution windows, last click, and what happens when two affiliates touch one player

The attribution window is how long after the click a conversion still counts. Nearly every iGaming program uses last-click attribution: if the player clicked a competitor's link after yours and inside the window, the competitor takes the commission and you see nothing — not a partial credit, nothing.

The practical consequences are three. First, being the last useful page before a signup is worth more than being the first. Second, comparison and review pages sitting close to the decision usually out-earn top-of-funnel explainers, even when the explainers bring more traffic. Third, a long window is only an advantage if you are the last click within it; on high-competition brand terms you rarely are. Read the window and the overwrite rule together — one without the other tells you nothing.

Reading the reports: clicks, signups, FTDs, and where each number comes from

Expect your click count to be the largest number in that table by a wide margin. On our own redirect log, filtering one month of raw clicks for bots and duplicates removed the majority of them, and the genuinely clean, human, in-market clicks were a small fraction of the raw figure. If you compare your unfiltered log with the platform's tracked clicks and conclude the platform is stealing from you, filter first. What that filtered picture looks like when it goes wrong is the subject of anatomy of a dead funnel.

Five tracking mistakes that hide your best pages

1. One subID for the whole site. Every conversion lands in one bucket, so you can never retire a page that does not work or double down on one that does.
2. Linking straight to the platform URL. Ad blockers block known tracking hosts, and you lose the click before it is counted. Route through your own domain and redirect server-side.
3. Missing rel attributes on outbound links. Affiliate links should carry the sponsored attribute; Google documents this in qualify your outbound links, and the affiliate relationship must be disclosed to readers on the page as well.
4. Changing subID shape mid-flight. Renaming tokens breaks the join between old conversions and current pages; your history becomes unreadable exactly when you finally have enough of it.
5. Never reconciling. Compare your click log against the platform report once a month. A link that shows clicks on your side and zero on theirs has been broken for however long you did not look.

Case: the geo header that sent every click to the wrong landing page

We route outbound clicks through our own redirect and pick a country-specific landing page from the visitor's country. The country was being read from the wrong request header, so the geo decision fell back to a default and a share of clicks landed on a page for the wrong market — readers arriving somewhere they could not register, on links that still counted as clicks. Nothing in the affiliate report said "broken". It looked like weak conversion.

Two lessons we would apply on any site. First, log the inputs to a routing decision, not just the outcome — we could only find it because the country value was in the log. Second, test the redirect from the market you serve, not from your own desk, because a link that works from your chair proves nothing about a reader two countries away.

A 30-minute setup checklist

1. Route every affiliate link through your own redirect path and log timestamp, source page, country and user agent.
2. Adopt the subID scheme above and write your tokens into one canonical list before you paste a single link.
3. Ask each affiliate manager two questions: what is the cookie window, and do you support postbacks with a click ID.
4. Where postbacks exist, expose the endpoint, register the macro template, verify the signature and store every field.
5. Add the sponsored rel attributes and a visible affiliate disclosure above the first outbound link on every page that has one.
6. Send one test click per program, confirm it appears in the platform report, and note how long it took to show.
7. Put a monthly reminder in the calendar to reconcile your log against every program report.

Once the data is flowing, the numbers become planning inputs rather than trivia: feed your own click and conversion rates into the traffic-to-revenue estimator to see which page type is worth writing next, and pair that with the acquisition side in SEO for iGaming affiliate sites. Any term above that was new is defined in the affiliate glossary.

Gambling content is for adults only, 18+ or the legal age in your market. Only send readers to operators licensed where those readers live, keep responsible-gambling messaging visible alongside every outbound link, and disclose the affiliate relationship before the reader clicks.

What we would do this week

1. Replace every direct operator URL on your site with your own redirect path, and give each link a structured subID from a single canonical list.
2. Email every program you are approved with, ask for the cookie window and postback support in one message, and register the postback template wherever the answer is yes.
3. Send one live test click per program from the market you actually serve, confirm it lands in the report with your subID attached, and record the reporting lag next to each program in your list.