Whenever your text content appears as an asterisk (*) (or 1 inside input element of a "number" type), you're seeing Hotjar's user privacy-protecting suppression feature in action.

We suppress numbers by default, but they can be disabled. It is important to note that numbers 9 characters or longer will always be suppressed. We see this the most with telephone numbers or credit card numbers.

You can read more about text suppression, including how to configure it, in our article about content suppression.

Hotjar suppresses user keyboard input and numbers embedded in page content by default but needs extra direction to suppress personal information contained in your page text content or images.

Solution: Our article about content suppression helps advise on how you can configure what Hotjar should and should not capture.

When suppressed, your Recordings will render this content as asterisks of slightly randomized length (*). This occurs on the user's device, meaning it is never stored on our servers.

A number of the problems discussed in this article advise using your browser console to look for error messages. These errors may appear on your site or in a Recording. If you need help accessing the console, each browser has its own documentation, linked below.

• Chrome
• Firefox
• Safari
• Edge
• Internet Explorer (bear in mind that Hotjar is not supported in Internet Explorer).

When you open the console, you will usually see warnings colored in yellow, and errors colored in red. Warnings can generally be ignored. Errors in red may be useful in diagnosing a problem.

In the example below, you can see an example of an error indicating a missing resource, indicated by the "404 (Not Found)" message.

When identifying reasons why Hotjar may not be capturing user data, inspecting the console while visiting your site can be helpful. Two common errors are:

• Content security policy errors.
• Errors related to specific values in Hotjar's scripts require access to being "undefined". These often mean that Hotjar is trying to access a native browser function that another script on your site has overridden, preventing Hotjar from tracking users properly.

Solution: These errors will need to be addressed by developers with access to your source code.

The console is instrumental in identifying errors that prevent Recordings from accessing fonts or images used by your site. You may see the following:

• 404 errors: these usually mean that the file Hotjar is trying to access is no longer available from the URL captured at the time of recording.
• 403 errors: these usually mean that a font or image file Hotjar is trying to access cannot be accessed without additional permissions. This is often because the file is behind a login or because your site disables other sites from accessing your images or fonts. These can usually be fixed by allowing insights.hotjar.com to access your images or fonts.
• CORS errors: we have detailed instructions on how to solve these errors in our article about fixing CORS errors.

If you try to watch a Recording and the playback never loads or shows a blank screen, it's possible that Hotjar encountered an error when attempting to render specific code changes in the user's session.

Because this issue isn't common and can be caused by a bug, it's best to contact support so our team can take a closer look.

If web fonts on your site aren't appearing in user playbacks, this usually means that they are only allowed to load from your domain. Since sessions are played back on the insights.hotjar.com domain, you may see errors in the console, such as:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://www.domain.com/fonts/your-font.woff. This can be fixed by moving the resource to the same domain or enabling CORS.

Solution: To fix this, you will need to enable CORS (cross-origin resource sharing).

Enable CORS on Apache

If you have access to the .htaccess file or the httpd.conf configuration file, you can add the following code to allow your font files to be loaded externally:

<FilesMatch "\.(ttf|ttc|otf|eot|woff|font.css|css)$">
      Header set Access-Control-Allow-Origin "*"
  </FilesMatch>

Enable CORS on nginx

If you have access to the httpd.conf configuration file, you can add the following code to allow your font files to be loaded externally:

if ($filename ~* ^.*?\.(eot)|(ttf)|(woff)$){
      add_header Access-Control-Allow-Origin *;
  }

For more information on how to enable CORS, you can check out enable-cors.org.

Ads, chat widgets, and many other third-party softwares installed on your site are loaded as iframes. In order to protect you from possible security threats when replacing Recordings, Hotjar suppresses all iframes from executing. This means we are unable to track iframe content on your site.

You can read more about how Hotjar handles iframes in our article about this.

Hotjar captures a user's interactions and the page itself during their session. Behind the scenes, we capture the page DOM and attach event listeners to DOM elements. Hotjar is unable to capture and track certain content types embedded in the DOM. Other DOM elements block Hotjar from accessing them.

Certain elements will render, but we may be unable to replicate user interaction:

• Video elements: since video player state is not held in the DOM, Hotjar cannot replicate user interaction with video player controls.

Elements that block both content and behavior capture include:

• Iframes elements: these are best thought of as pages-inside-pages. Potential security threats associated with iframes mean Hotjar cannot track iframe content. Learn more about iframes in Recordings.

  Third-party tools that are embedded as iframes that we cannot support include:

  • Google Maps
  • Chatbots
  • Third-party forms providers

• Canvas elements: used for drawing graphics, including games and many graphical tools. This includes 3D graphics created with WebGL. Canvas content is not exposed to the DOM, meaning Hotjar cannot access it.

  Commonly, we see this associated with 3D/2D drawing tools and games.

These content types are unsupported:

• Adobe Flash: this was retired in December 2020.

On some occasions, you may notice that Recordings are either split into separate Recordings or stop abruptly. This could happen for any of the following reasons:

• Hotjar keeps tracking a session even if your user is idle for a few minutes. If a user is idle for over 30 minutes, Hotjar will automatically end that session. If that user later returns, they will start a new Recording session. If you see Recordings being split, check the time they were added, it could be the user was idle for over 30 minutes or left your site and returned to it later on.
• The Hotjar Tracking Code is not present on all pages so Hotjar is not able to record all sessions.
• Hotjar is unable to track users that are moving to pages across multiple top-level domains. An example of this is when a user moves from www.example.com to www.example.co.uk.

Hotjar servers need access to the assets on your site to generate Recordings successfully. When the CSS looks broken, this typically means our servers have difficulty fetching some of the CSS files from your server.

There are a number of things that could cause this. Here are the known reasons why sites may block Hotjar from accessing CSS:

• Blocking access based on geolocation or your site only allows specific IPs to access assets
• Blocking based on domain/referrer
• Blocking based on lack of cookie/sessionStorage

Solution: Referrer and IP blocking-based issues can be addressed by:

• Allowing the IP addresses listed in Hotjar IPs.
• Allowing the domain/referrer https://insights.hotjar.com

If you notice that your Recording/Heatmap doesn't show any user scrolling, or shows an unusual scroll cut-off, this may be the result of a known issue with Javascript and a specific CSS property.

JavaScript has a limitation where it is unable to detect scrolling when both the HTML and body elements of a page have overflow-x: hidden set in the CSS. This limitation is not Hotjar-specific, so it's not something that Hotjar Support can resolve. For more information about this limitation, see this relevant Stackoverflow post.

Solution: Removing overflow-x: hidden from either the body or HTML in your CSS should resolve this issue.

If you've started recording but cannot see any new Recordings being added after a few hours, this may mean that the Hotjar Tracking Code isn't correctly installed. You will need to confirm that all pages on your site have the Hotjar Tracking Code installed properly.

If Hotjar is installed correctly, Session capture is enabled in your Site Settings, and you are still not seeing any Recordings, check your browser developer console. You can check your browser developer console by following the steps in this guide.

If there is a Content Security Policy issue, you will see something similar to the below error:

You can read more about CSP issues in our article about content security policy settings.

You might experience instances where other tools, such as Google Analytics, report more visits than Hotjar has Recordings.

Solution: Our article, Does Hotjar Record all my users? outlines reasons Hotjar may not Record a user based on settings you've enabled or is prevented from capturing a session based on the user's local device configuration.

To provide a more secure experience in Hotjar, we don't capture pages that are served using the HTTP protocol. Hotjar will only capture pages being sent over HTTPS. This also applies to development environments that are using HTTP, such as testing with localhost. In addition to Heatmaps and Recordings, this includes Feedback widgets and Surveys, which won't display on pages using HTTP. For help on moving your site to HTTPS, see this guide from Google on the steps you can take.

In general, yes, Hotjar works behind a login. User data and the page state information is sent directly to us from the client, so Hotjar doesn't need to access the page directly. The key thing to consider is that Hotjar servers do need access to your site assets (CSS, images, fonts) in order to render the recordings correctly.

There are some technical obstacles that you may encounter to achieve this, depending on how your servers are configured, but very often, tracking users behind a login will work. This applies to Heatmaps as well.

To stop Recordings from being collected, you can turn off Session Capture within the Site Settings menu. It is not possible to programmatically stop recordings for sessions that are already in progress. If a session began and Hotjar started tracking it, it's not possible to end it while the session is still active.

If Session Capture is disabled, it is possible to target Feedback and Surveys using Events or User Attributes. However, there will not be any recordings for sessions connected to Survey or Feedback responses, so user attributes will not be associated with responses. Check our pricing page to see if your Hotjar subscription includes access to Events and User Attributes features.

There may be a date filter applied. If you see a 0 followed by a number, such as 0/999, this means you have 999 Recordings total, and none are showing on the list.

Solution: Change the date range filter to Last 90 days or Custom date range in order to see more of your Recordings.