A session recording can help you understand a confusing page or a form that visitors abandon. It can also include page structure, text and interactions that deserve careful handling. Before collecting recordings, check what the recorder can capture, what stays masked and how a visitor’s consent choice affects collection.
In Hitsteps, recording is enabled separately for each website. Installing the tracking code alone does not turn it on. That gives you a point to review privacy settings before recording begins, rather than treating the settings as a cleanup step afterward.
Start with what a recording can contain
Recording captures a sample of visits. Depending on the controls you enable, it can include page structure and text, clicks, scrolling, pointer and touch movement, form interactions and diagnostics.
Review the pages you intend to record before enabling collection. A public product page and a signed-in account page can contain very different information. Decide which pages belong in the sample and which areas should stay hidden. Collecting fewer details can still leave you with enough context to understand where a visitor gets stuck.
Use Protected text privacy, then check the exceptions
Open Experience > Settings and find Privacy & masking. Start with Protected under Text privacy. Protected masks text, but it is important to review Visible text exceptions: those exceptions can make selected elements readable even in Protected mode.
For content that must stay hidden, use Mask elements or Always mask these elements. These explicit mask lists take priority over visible-text exceptions. Passwords and payment fields remain masked.
Keep exceptions narrow. A public product heading may be useful to read in a replay. A heading that includes a signed-in customer’s name needs different treatment. Retest your selectors when your website changes, because the same selector may start matching different content.
Text rendering is a separate choice. It changes how masked words look, not which text is allowed to be readable. A different masking appearance is not a different permission to reveal personal text.
Check what Yes, No and no answer actually do
In Hitsteps’ built-in popup flow, Yes allows recording to proceed when the other recording conditions are met. No, or no answer, prevents recording. Basic analytics can still continue without identity enrichment.
That distinction matters when you test consent. Seeing a pageview in an analytics report after choosing No does not, by itself, mean a recording was made. Check the recording outcome separately from the basic analytics outcome.
The popup uses your website’s configured text. It does not automatically add an explanation of session recording, so review both that wording and your privacy notice. If you use another consent platform, test the actual integration. The presence of a banner alone does not establish that it controls Hitsteps recording.
Keep exclusions and browser choices in scope
Leave Respect Do Not Track enabled in recording settings. Review Include pages, Exclude pages and Excluded IP addresses too. Recording page exclusions take priority over includes; these rules do not prevent someone from opening the page or change ordinary analytics by themselves.
For your own visits, use Settings > Advanced > Exclude this browser on your domain > Open my website. This also stops that browser’s visits being counted or added to heatmaps and hides the website’s Hitsteps chat box there.
Repeat the exclusion for each browser profile and device you use. Clearing the website’s cookies can remove the saved choice. An exclusion on your work laptop does not automatically cover your phone. A visitor’s saved opt-out is also browser-specific. Cookie restrictions and using another device matter when checking whether that choice applies to a visit. These controls prevent future collection; they do not erase earlier visits or recordings.
Treat the settings as part of your privacy process
Privacy controls do not certify compliance or decide your website’s legal basis. Hitsteps’ privacy and data controls guide explains the separate roles of consent, exclusions, masking, retention and deletion.
Before relying on a configuration, use a test page with fictional values and inspect a permitted replay. Check readable public text, masked private areas and skipped paths. Test the built-in popup with no answer, Yes and No. Review diagnostic collection too: masking page text does not make arbitrary application log messages safe.
For the setup steps, read the session recordings guide.
