How to See What Users Do on Your Website

To see what users do on your website, add a session recording tool: a small script that records each visit so you can watch it back, with clicks, scrolling, page changes and masked typing in the order they happened. Analytics, heatmaps, user testing and simply asking people fill in the rest of the picture, and each answers a different question.

This guide compares those options, explains how website session recording works under the hood, walks through a first install step by step, and covers the privacy questions you should settle before you press record.

Can I see what visitors do on my website?

Yes, with a few different levels of detail. None of them is complete on its own.

If you want to watch real visitors rather than read numbers about them, session recording is the method that shows it directly. The rest of this guide is about that. Session replay vs analytics goes deeper on when each tool wins.

How a website session recording tool works

The phrase "screen recording website visitors" suggests video, but almost no modern tool films the screen. Instead the script takes a serialised snapshot of the page structure, the DOM, when the page loads, then records every change as a small timestamped event: an element added, a class changed, the mouse moved, the page scrolled. A player later rebuilds the page from the snapshot and applies the events in order. DOM recording is covered in more detail in what is session replay.

That design has practical consequences. Recordings are small, because a page that is not changing produces no events. Text fields can be masked in the browser before anything is sent, which is impossible with pixels. And the replay is inspectable: you can see which element someone clicked, not guess from a blurry frame.

AnyReplay records the web this way with an rrweb-based browser SDK. It never records script bodies, and it replays inside a sandboxed iframe that cannot run code.

How do I record user sessions on my website?

The steps are the same for any session recording tool. The details below use AnyReplay as the example.

1. Pick a tool. Decide what else you need alongside recordings: heatmaps, funnels, console logs, a free tier, self-hosting. Free session replay tools compares common options honestly, including where AnyReplay is not the right fit.
2. Install the snippet. Most tools give you a script tag for the <head> of every page, or an npm package if you build with a bundler. Integrations has setup pages for frameworks and site builders such as Next.js, WordPress and Webflow. A tag manager works too.
3. Decide what to mask. Check what the tool does with form inputs. AnyReplay masks form fields by default and records what visitors type only if you set maskAllInputs: false; passwords, one-time codes and payment fields are masked whatever you configure. Add ar-mask to text that shows personal data, such as an account page, and ar-block to anything that should not be recorded at all.
4. Wire up consent if you need it. If your privacy setup requires consent before recording, start the recorder in a waiting state and release it from your banner. With AnyReplay that is requireConsent: true and anyreplay('consent', true).
5. Verify the install. Load your site, fill in a form, visit two pages, then open the session. Confirm the inputs replay as asterisks, route changes appear, and nothing you marked is visible.
6. Watch the first ten sessions. Do not wait for a question. Ten ordinary visits will show you more about how people move through the site than any setting you tweak first.

A minimal AnyReplay install with consent looks like this, once the snippet from your project has been pasted:

anyreplay('init', { projectKey: 'YOUR_PROJECT_KEY', requireConsent: true });

// later, when the visitor accepts analytics in your banner
anyreplay('consent', true);

Single-page apps need nothing extra: AnyReplay detects History API route changes and marks each one on the timeline. Full step-by-step instructions are in the quick start.

What to watch for

Watching sessions at random is slow. Start from signals that point at trouble.

• Rage clicks. Several fast clicks on one spot mean something did not respond. AnyReplay flags them while recording, and the session list has a Rage clicks filter. How to fix rage clicks covers the causes.
• Errors. Sessions where a JavaScript error fired are flagged and filterable. Watch what the visitor did just before it.
• Dead ends. A click followed by nothing at all. Dead clicks explains how to spot them.
• Hesitation. Long pauses on a form field, scrolling up and down a pricing table, returning to the same page twice.
• Key flows. Mark steps such as sign-up or checkout with custom events, then filter the list to sessions that contain them.

How to analyze session recordings turns this into a repeatable review routine.

Is it legal to record website visitors?

In many places it can be, when it is done carefully, but the answer depends on where you and your visitors are and what you record. This is not legal advice; check with someone qualified for your situation. In practice, careful recording usually rests on four things.

• Masking at the source. Personal data such as names, emails and payment details should never leave the browser. See how to mask sensitive data.
• Consent where required. Some jurisdictions and some interpretations require opt-in before recording. A recorder that records nothing until consent makes that easy to follow. Session replay and cookie consent goes into the details.
• Short retention. Keep recordings only as long as you use them. AnyReplay keeps them for 14 days by default, configurable per organisation from 1 to 365 days.
• Disclosure. Say in your privacy policy that you record sessions, what you mask, who processes the data and how long it is kept.

Session replay and GDPR covers the European view in more depth.

Do session recordings slow down my site?

A well-built recorder should not be noticeable, but it is a script running on your visitors' devices, so ask any vendor for its size and its behaviour when the network fails. AnyReplay's browser SDK is about 35 KB gzipped, with a 45 KB budget enforced in CI. It loads asynchronously, sends events in batches rather than per click, and when the network fails it waits longer between retries instead of hammering it. Does session replay slow down your site looks at the trade-offs.

Frequently asked questions