Heatmaps and Session Recordings: What They Show and What They Don't
Heatmaps aggregate clicks and scroll; session recordings show single visits. What they tell you, how to read them without fooling yourself, and data privacy.
What does each tool show?
A click heatmap shows where people clicked and how often. A scroll map shows how far down the page people got. A movement map follows the cursor. A recording replays what one visit did: what moved, where it paused, what was typed (or not), and when it was abandoned.
The key difference is scale. A heatmap answers “what do people generally do?”. A recording answers “what happened in this visit?”. Confusing the two leads to wrong conclusions: a dramatic recording doesn’t represent the whole, and an aggregated map doesn’t explain a specific problem.
Why should a designer care?
Because they show you what analytics doesn’t. A funnel tells you people abandon at the shipping details step. A recording shows you that the “Continue” button sat under the virtual keyboard on a small phone. That detail changes the solution.
They also reveal broken expectations. A CTA with few clicks may mean people don’t recognize it as interactive. A deep scroll with little time on the page usually means people are searching, not that they are interested.
How do you read them without fooling yourself?
Lean Experiments sums up the idea well: heat maps are not answers; they are better questions (Lean Experiments, “Mouse tracking and heat maps”). A few practical rules:
- Be wary of the movement map. The link between cursor and attention is far from perfect. Trust it much less than the click map.
- Use the scroll map to locate the real fold. It shows whether what matters sits below where most people stop.
- Segment before concluding. New versus returning users, mobile versus desktop, and traffic source all change the pattern.
- Move from observation to hypothesis. If many clicks land on text that isn’t a link, the hypothesis is that people expect a link there. Validate that hypothesis with a test.
- Check the volume. With few visits, a pattern can come from a single person’s behavior.
When are recordings useful?
Recordings help you understand how someone behaves in a flow you already know is failing. LSEO warns that a replay can show what happened on the page but not always why, and that three users with the same problem don’t automatically prove it is universal (LSEO, “How to use session recordings responsibly”).
So the order is: aggregated data first (funnel, click map), then a few recordings to understand the mechanism, and finally a usability test or an experiment that confirms the fix.
Example
Illustrative example: a secondhand marketplace sees in its funnel that 35% of people who reach the price screen never publish their listing. The click map of that screen shows many clicks on the “Minimum price” label, which isn’t an editable field. Recordings of six visits show people typing into that label, assuming it is a field, and getting confused. The team hypothesizes that the field should look like a field. The test changes the field’s appearance, and the publishing rate goes up. The recordings gave the mechanism; the funnel and the test gave the evidence.
Privacy: what not to record
This part isn’t optional. Matomo states that its script masks all input, textarea, and password fields by default, and that sensitive fields such as passwords and credit card inputs are always masked (Matomo, “Data masking in heatmaps and session recordings”). Even so, review the configuration before you switch the tool on.
LSEO proposes a broader list to mask or exclude before collecting data: passwords, payment card data, government identifiers, health information, and private message content; depending on the business, also account numbers, internal search queries, and uploaded documents. Its principle is that good configuration captures behavior, not unnecessary content (for example, that someone abandoned the phone field, without storing the value). Access to recordings should follow the least-privilege principle, and recordings should be kept only as long as they serve a documented purpose.
Consent matters too. Matomo says that, because these features access the visitor’s device, laws implementing the ePrivacy Directive require prior consent. Check with your legal team what applies in your country before enabling them.
When NOT to use them
- If you don’t have a specific problem to solve. Watching recordings without a question wastes time and generates data nobody uses.
- If the site hasn’t passed a privacy review. No conversion gain justifies recording personal data without protection.
- To decide a strategy. Maps explain behavior on a page. Strategy depends on other data.
- As a statistical proof. Ten recordings aren’t a representative sample.
Common mistakes
- Showing recordings of extreme cases as if they were the norm (a handful of dramatic recordings can distort decisions).
- Reading the movement map as an attention map.
- Concluding without segmenting.
- Not masking sensitive fields because “the tool does it automatically”.
- Keeping recordings indefinitely, with no documented purpose or retention limit.
How to start tomorrow
Pick the funnel step with the most abandonment. Review the click map of that screen and note which element gets clicks without being interactive, or gets none while being important. Before watching any recordings, confirm that sensitive fields are masked and that access is restricted. Then watch six recordings of visits that abandoned that step, and write a hypothesis in one sentence. If you want to go deeper on the qualitative side, the Hotjar for UX tool entry and eye tracking are two complementary routes. And read the funnel analysis of the same flow to see the numbers behind the picture.