Session-replay or behaviour-recording script is present

Why it matters

This page loads a session-recording tool. Session-recording tools like this can capture what visitors type, on-screen content, and mouse movement, which often includes personal data entered into forms. Recording that data normally calls for input masking, a clear disclosure, and — in the EU/EEA and UK — the visitor's consent. Confirm masking is on and that its use is disclosed.

How ShipReady detects it

Per-page privacy signals read straight from the fetched HTML and response headers — no extra requests. Page-scoped because trackers, cookies and forms genuinely differ between routes (a marketing homepage vs a bare /login), and the route that carries the signup form is exactly the one worth seeing.

Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.

How to fix it

This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.

A session-replay tool (Hotjar, FullStory, LogRocket, Microsoft Clarity, and similar) is loaded on this page. These scripts can record what visitors type and the content on their screen, which frequently includes personal data. Turn on the tool's input-masking / suppression settings so form fields and sensitive text are never captured, disclose the recording in your privacy policy, and — for visitors in the EU/EEA and UK — obtain consent before recording. If you do not actively use the recordings, remove the script.

Frequently asked questions

What does "Session-replay or behaviour-recording script is present" mean?

This page loads a session-recording tool.

How serious is it?

ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.

How do I fix it?

Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.

Can I check my own site?

Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.

Related checks

• A device-fingerprinting script is presentmedium
• A form collecting personal data submits via GETmedium
• Tracking cookie is set before the consent banner can be answeredmedium
• Tracking cookie is set on the first responsemedium
• Analytics or advertising tracker loads without a detected consent steplow
• Fonts are loaded from Google's serverslow