Affiliate Tracking

How to track referrals reliably with cookies, attribution windows, and first-touch vs last-touch models.

Why

Affiliate tracking is the technical foundation of the program: if you cannot reliably attribute a conversion to the affiliate who referred it, you cannot pay them, and the program collapses. The standard mechanism is a cookie: the affiliate's link sets a 30-day cookie on the visitor's browser, and when the visitor converts, the cookie attributes the conversion to the affiliate. The challenges are: cookie blocking (Safari ITP, Firefox ETP block first-party cookies for cross-site tracking), multi-touch attribution (a visitor clicks an affiliate link, then a Google ad, then converts — who gets credit?), and fraud (an affiliate sets their own cookie and buys through their own link). The right design uses a 30-day last-touch attribution window (the last affiliate click before conversion gets credit), server-side tracking (to bypass cookie blocking), and fraud detection (reject self-referrals and suspicious patterns). The most common mistake is using first-touch (the first affiliate gets credit forever) — this over-credits the first affiliate and under-credits the one who actually closed the sale.

When

At program launch. Revisit the attribution model if you see affiliates complaining about 'stolen' conversions or if the program's conversion rate seems too low.

How

1. Use a dedicated affiliate platform (Rewardful, Partnerstack) — they handle cookie setting, attribution, and fraud detection; do not build your own
2. Set a 30-day attribution window — this is the industry standard: long enough to capture research-heavy purchases, short enough that affiliates are not credited for organic conversions months later
3. Use last-touch attribution: the last affiliate click before the conversion gets the commission — this credits the affiliate who actually closed the sale, not the one who introduced the user
4. Implement server-side tracking: when the user converts, your backend queries the affiliate platform's API for the attribution, rather than relying on a browser cookie that may be blocked
5. Handle multi-touch: if a user clicks Affiliate A, then Affiliate B, then converts, Affiliate B gets the commission (last-touch); Affiliate A gets nothing — this is standard and affiliates understand it
6. Detect fraud: reject self-referrals (affiliate's own account), reject conversions from the affiliate's IP address, and flag affiliates with > 50% conversion rates (suspicious — likely cookie stuffing)
7. Handle returns and chargebacks: claw back the commission if the customer refunds within 30 days — do not pay commission on refunded revenue
8. Provide a real-time dashboard for affiliates: clicks, conversions, pending commissions, paid commissions — transparency builds trust and motivates affiliates

Example

# Affiliate tracking flow (using Rewardful)
// 1. Visitor clicks affiliate link: /ref/abc123
//    Rewardful sets a 30-day cookie: affiliate_id=abc123

// 2. Visitor signs up (server-side tracking)
app.post("/signup", async (req, res) => {
  const user = await createUser(req.body);
  // Rewardful tracks the conversion server-side
  await rewardful.track("signup", {
    customer_id: user.id,
    affiliate_id: req.cookies.affiliate_id,  // or from Rewardful API
    amount: 29.00,
  });
  res.json(user);
});

// 3. Attribution: last-touch, 30-day window
//    If user clicked affiliate A on day 1, affiliate B on day 20, converted day 25
//    → affiliate B gets the commission (last click within 30 days)

// 4. Fraud detection
function isFraud(affiliate: string, customer: string) {
  if (affiliate === customer) return true;           // self-referral
  if (sameIp(affiliate, customer)) return true;      // same IP
  if (conversionRate(affiliate) > 0.5) return true;  // suspiciously high
  return false;
}

Common Problems

⚠Using first-touch attribution — the first affiliate gets credit forever, even if another affiliate closed the sale months later. Use last-touch (last click before conversion) to credit the closer.
⚠Relying on browser cookies alone — Safari ITP and Firefox ETP block cross-site cookies, so 10-20% of conversions are not tracked. Use server-side tracking via the platform's API.
⚠Not detecting self-referrals — affiliates buy through their own link to get a discount, costing you the commission. Reject conversions where the affiliate and customer are the same.

Best Practices

✓Use last-touch attribution with a 30-day window — this credits the affiliate who closed the sale, which is what affiliates expect and what drives the right behavior (closing, not just introducing).
✓Implement server-side tracking via the affiliate platform's API — this bypasses cookie blocking and captures the 10-20% of conversions that browser-only tracking misses.
✓Detect and reject self-referrals, same-IP conversions, and suspiciously high conversion rates — fraud erodes the program's economics and demotivates honest affiliates.