QR Codes Already in Print: Tracking Them and Changing Where They Go

You’ll know which of your printed codes you can still repoint, and how to send the next batch so every code in it can be.

A printed QR code never changes, so print a URL you can repoint. Encode a short link on your own domain, not the long tagged URL, and keep the UTM parameters on the destination behind it. Then a moved landing page is an edit on a record, not a reprint, and every scan arrives tagged.

TL;DR

A static QR code encodes its URL in the pattern itself. Change one character of the URL and you have a different code.

A “dynamic” QR code is a static code that encodes a short link. The short link is what you edit.

Codes already printed with a final URL can often still be rescued with a redirect on your own site. Only a URL on someone else’s site forces a reprint.

Put the UTM parameters on the destination, not on the printed link, and use a redirect browsers won’t cache.

Print your own domain, from an account the organization owns. Vendors document it plainly: cancel or let a trial lapse and dynamic codes stop redirecting.

Check the approval, the domain, the fallback and a real scan before anything goes to the printer.

Why This Keeps Coming Up

QR codes come up in our sales calls more than you’d expect for a feature we once thought of as a side dish. Across two years of sales-call notes, prospects mentioned them in more than a third of our calls, and the stories that stick involve print: posters, direct mail, packaging, letters to members.

The stories rhyme. A marketer at a manufacturer told us their teams had built codes straight from the long tagged URL and sent them to print. Then a parameter needed fixing, and there was nothing to fix: a corrected URL meant a new code, and the old one was already on paper. A print run lives for months or years. The web behind it doesn’t sit still that long.

Static Codes Are Carved in Stone

A QR code is data drawn as squares. The URL is not stored anywhere else. It is the pattern.

That has two consequences people learn the hard way.

First, a code can’t be edited. Change utm_campaign=spring to utm_campaign=spring_2026 and the encoder produces a different arrangement of modules. The poster on the wall still carries the old one, forever.

Second, long URLs make worse codes. DENSO WAVE, which invented the QR code, explains that “as the amount of data increases, more modules are required,” from 21 by 21 modules at Version 1 up to 177 by 177 at Version 40. The tagged destination in the example below runs to 136 characters; its short link is 26. Print both at the same physical size and the tagged one has smaller squares, which is what a phone camera struggles with on a curved bottle or across a waiting room.

So what is a “dynamic” QR code? The name suggests a different technology.

A dynamic QR code is a perfectly ordinary static code that happens to encode a short link. The phone opens the short link, a server looks up where that link currently points, and redirects. The pattern is frozen. The lookup isn’t.

Which leads to the one rule this whole page rests on.

Never print a URL you can’t edit.

If the thing in the code is the final destination, every future change costs a reprint, or at best a redirect ticket to your web team if the URL is on your own site. Another manufacturer told us its packaging codes had, more than once, needed an entirely different destination after the boxes were already made. With a short link in the code, that’s a form field.

Triage for Codes Already in Print

A marketer at a healthcare organization asked us the question this section answers. The short link was already printed, the destination behind it was wrong, and how do you change it?

What you can do depends on what the printed code contains. Scan it with an app that shows the text before opening it, then find your case.

A short link on your own domain. The best position to be in. Edit the destination on the link, then scan a printed piece to confirm it lands where it should.

A short link on a generator’s domain. The code works only as long as that account does. Move the account to a login the organization owns, with at least two admins if the vendor supports it, and keep it paid until the last piece of that print is retired. Export or copy down every code and its destination while you still have access. Next run, use your own domain.

A final URL on your own site. Ask your web team for a 302 redirect that matches that exact printed URL, query string included, and sends it wherever it should go now, with the UTMs kept or corrected. Matching only the printed URL leaves visitors from search or email untouched. If the target is a tagged version of the same path, make sure the rule doesn’t match its own target, or the page loops. The same redirect adds tracking to a printed path that was never tagged, as long as nothing but print uses that path. Scan to verify.

A final URL on a site you don’t control, such as a ticketing page, an app store listing or a partner’s site. You can’t redirect it. This is the one case that truly needs a reprint.

Put the Short Link in the Code and the UTMs Behind It

The pattern is a chain of three things, and each one has a different job:

Layer	Example (illustrative)	Can it change after printing?
Printed code	encodes `https://go.example.org/flu`	No
Short link	`go.example.org/flu`	Its domain and slug, no. Its destination, yes
Destination	`https://www.example.org/flu-shots?utm_source=qr_code-bus_shelter&utm_medium=offline&utm_campaign=flu_season-2026_10&utm_content=poster_a`	Yes

The printed code only ever knows the short link. The short link knows the destination. The destination carries the tracking.

The parameter values follow the same recipe as any offline placement: a specific source that says where the code physically lives, a consistent medium, and utm_content to tell print variants apart. The UTM Cheat Sheet in our guide has the full QR and offline recipe, including the event variant where one campaign spans booth, session and follow-up codes.

Two technical details decide whether this chain actually delivers tagged traffic.

Keep the UTMs on the stored destination

A redirect sends the browser to whatever URL the server puts in the Location header. HTTP does not carry the original request’s query string across on its own. RFC 9110 makes the fragment (the #part) inherit through a redirect, and says nothing of the kind about the query.

So a UTM string appended to the printed short link only survives if that particular shortener chooses to copy it forward. Don’t rely on it. Store the full tagged URL as the destination and print the bare short link.

Use a redirect browsers won’t remember

This one is subtle and it matters more for print than for anything else.

A 301 (Moved Permanently) is, per RFC 9110, “heuristically cacheable.” Unless the response says otherwise, a browser that has followed it once may reuse it later without asking the server. A 302 (Found) is not: under RFC 9111, a cache only reuses one when the response explicitly allows it, and RFC 9110 describes a 302 as a redirection that “might be altered on occasion.”

Now picture a patient who scanned the flu-clinic poster in October and scans it again in January, after you repointed the link. With a cached 301, their phone may skip your shortener entirely and open October’s page. And the shortener never sees the second scan, so it never counts it.

A link you intend to repoint should answer with a 302. Terminus, the marketing taxonomy governance platform, answers with one. The checklist below shows how to check any shortener’s response.

Print Your Own Domain, Not a Generator’s

The short link in the code has two halves: a hostname and a slug. Most teams think hard about the slug and not at all about the hostname.

Call a generator’s hostname in your code the borrowed hostname. Everything printed with it depends on a company you don’t control continuing to resolve that domain, for your account, indefinitely.

Your own subdomain (go.example.org, links.example.edu) changes the dependency. The DNS record is yours. If you ever change link providers, you can point that record somewhere else and recreate the slugs, and every printed code comes with you. A borrowed hostname offers no such exit.

It also reads better. Another healthcare organization we spoke to already put vanity URLs on billboards and member letters for that reason: people type and trust an address that looks like the organization that sent it. Print the short link as text next to the code, and the few people who can’t or won’t scan still have a way in.

Terminus lets you put these links on your own domain. Every account has a default shortener domain; for print, add your own. Custom domains are on every plan. Setup is a single DNS record and a verification check, and Terminus issues and renews the HTTPS certificate for you. Short links and QR codes are then minted on that domain from the same governed record that built the tagged destination, so nobody copies a URL from a spreadsheet into a generator. Once a link is live, its domain and slug are frozen, which is what makes it safe to print, and its destination stays editable. The short links page covers the setup.

Two domain features exist specifically because print is unforgiving:

Fallback page. Give the domain a fallback and any slug that misses lands on your own page instead of a 404. Someone who mistypes the short link off a mailer ends up on your homepage, not a dead end.
Domain monitoring. We keep checking the domain. After three failed checks in a row, the account’s owners and admins get an email, and another when it recovers. Without that, a dead domain tends to surface when someone mentions the poster doesn’t work.

What Happens When the Generator Account Lapses

This part isn’t speculation. The vendors say it themselves, in their help centers, at the time of writing.

QRfy’s support article on trial expiry: “Any Dynamic QR Codes that you created during the trial period will be deactivated and linked to a service page.” (source)

The QR Code Generator (the-qrcode-generator.com), in its article on cancellation: “All QR codes created on your dashboard will be deactivated. Once deactivated, these codes will no longer function, and anyone attempting to use them will encounter an error or inactive link.” It adds that cancellation “cannot be undone once confirmed.” (source)

To be fair to them, this is disclosed, and it follows from how dynamic codes work. The same help center notes that static codes “are permanent and unaffected by account status,” because nothing sits between the phone and the URL. The redirect is a service, and a service stops when nobody pays for it.

That is true of every hosted redirect, ours included. If a Terminus account is canceled or goes unpaid, its short links stop resolving too. Reactivate it and they resolve again straight away, with nothing to republish.

So the real risk isn’t that dynamic codes can die. It’s who holds the account. A marketer at a life sciences company told us each group there picked its own free QR builder, and nobody could say which account had made which code. Here is how that goes wrong:

Someone in events needs a code for tomorrow’s signage and signs up for a free trial with their work email.
The code works, gets reused on a brochure, and then on packaging.
The trial ends, or the person leaves and their account is closed with their mailbox.
Months later, somebody notices scans have dropped to zero. The printed codes now open a vendor’s deactivation page.

Nobody did anything wrong at step one. The failure is that the code was never an organizational asset. It belonged to a login.

Four things prevent it: an account the organization owns, kept paid, on a domain the organization owns, with a record of every slug and its destination somewhere a successor can find. In Terminus that record is the governed campaign record itself, visible to the team rather than to whoever happened to make the code.

Track Scans by the Fields You Govern

A scan from a phone camera usually arrives with no referring page. Without campaign parameters, your web analytics has little choice but to file it as Direct, and a year of poster traffic dissolves into the same bucket as people typing your homepage.

The UTMs on the destination fix that in your web analytics. One more trap: GA4’s default channel group has no rule for print, so a medium like offline lands in Unassigned until you add a custom channel group for it. Decide that once, in your convention, not per campaign.

Link-level analytics answer a different question. Your web analytics measures what someone does after they land. The shortener measures the scan itself, including scans from people who bounced before your analytics tag ever loaded.

Terminus separates the two sources on the same link. The code encodes a variant of the short link that marks the visit as a scan, so the poster and the email that share one record report as one record, and you can still see which did the work. Someone who types the short link off the mailer counts as a click, and someone who scans counts as a scan.

The bigger difference is what you can group by. Every click and scan carries a snapshot of the record’s field values as they stood at that moment: business unit, region, service line, funnel stage, whatever your governance model defines. So a health system (to take an illustrative case) can ask how many scans came from the cardiology service line’s print this quarter, filter to one region, and break the rest down by campaign. Country, device and operating system sit in the same list.

The snapshot detail matters for repointed codes. Say you move a poster’s link from the October flu campaign to a January wellness campaign (illustrative). October’s scans stay counted under October’s values. The history doesn’t rewrite itself because the destination changed.

The QR codes page shows the scan and click split, and the analytics page shows the field-based breakdowns.

The Pre-Print Checklist

Run this before any file goes to a printer or a mail house.

The code encodes a short link, not the final URL. Open the code in a scanner app and read the text. If you see utm_ in it, stop.
The short link is on a domain you own. Not a generator’s hostname, not a personal account.
The redirect won’t be cached. Run curl -s -o /dev/null -D - https://go.example.org/flu and read the status line and Cache-Control. A 302 or 307 is safe unless it carries a long max-age; a 301 or 308 without no-cache, no-store or a short max-age is the one that strands repeat scanners.
The destination carries every UTM parameter, with a specific source for this placement and a utm_content value if there are print variants.
If your process has approvals, the record is approved. A record that can still change is a code that can still be wrong. Terminus shows a warning in the download dialog until the submission is approved (approval workflows are on Business and Enterprise).
The domain has a fallback page and monitoring alerts reach someone who will act on them.
The account that owns the code is the organization’s, paid for, with more than one admin.
You scanned the real proof, at printed size, with two different phones, and read the landing page URL on both. Every UTM parameter should be there, spelled exactly as your convention says. Screens lie about print.
Vector format for anything large. Send SVG or PDF so the printer scales it cleanly. Terminus exports PNG, JPEG, SVG or PDF.
The quiet zone is intact. DENSO WAVE specifies a four-module margin on all sides. Designers love to crop it.
The logo isn’t eating the code. Error correction is what lets part of a code be covered; the highest level, H, restores about 30 percent. Terminus pins H and caps a logo at half the code’s width.
The short link is printed as text too, for the people who type.

For a hundred store locations or a code per SKU, don’t work one at a time. The bulk grid builds a row per placement, up to your plan’s bulk limit (pricing), each with its own link and code, and checks every row against your convention before anything is created.

If you’re still choosing a shortener, our roundup of URL shorteners lists the options. Hold each one to this checklist, especially items 2, 3 and 7.

FAQ

What is the difference between a static and a dynamic QR code, and can a printed one be changed?

A static code encodes the final URL directly, so its destination is fixed. A dynamic code encodes a short link that redirects, so the printed pattern stays the same while the destination behind the link can be edited. Only a code that encodes a redirect you control can be repointed.

My QR code is already printed with the wrong link. What can I do?

Scan it and read what it contains. A short link on your own domain: edit the destination. A short link on a generator’s domain: secure and keep paying for that account, then use your own domain next time. A final URL on your own site: ask your web team for a 302 redirect that matches that exact printed URL. A final URL on a site you don’t control: that one needs a reprint.

Should UTM parameters go in the QR code or on the destination?

On the destination. Print a bare short link and store the fully tagged URL as its destination. Redirects don’t carry the printed link’s query string across unless the shortener chooses to, and shorter content makes a less dense, easier-to-scan code.

Does a 301 or a 302 redirect matter for QR codes?

Yes. A 301 is heuristically cacheable under RFC 9110, so a phone that scanned before may reuse the old destination without asking the shortener, and that scan goes uncounted. A 302 isn’t cached unless the response explicitly allows it, so a repeat scan goes back to the shortener.

Do dynamic QR codes expire?

The printed pattern never expires, but the redirect behind it can stop. Vendors including QRfy and The QR Code Generator state in their help centers that dynamic codes are deactivated when a trial expires or an account is canceled. That applies to any hosted redirect, including Terminus, which is why the account should belong to the organization and the domain should be yours.

Why use a custom domain for QR code short links?

The code stops depending on a vendor’s hostname. You control the DNS, and if you change providers you can point the domain elsewhere and recreate the slugs rather than reprinting.

How do I track QR code scans separately from link clicks?

Use a shortener that tags scans at the redirect, so a scan and a typed or clicked visit to the same link are counted apart. In Terminus, for example, the code encodes a variant of the short link that records the visit as a scan, and one record reports scans and clicks side by side, grouped by your own governance fields.

Why do QR code visits show up as Direct in GA4?

A camera scan usually has no referring page. Without UTM parameters on the destination, GA4 has nothing to attribute the visit to. And if you use a medium like offline, add a custom channel group, because the default channel group has no rule for it.