Session Replay for WordPress Sites

To add WordPress session replay with AnyReplay, put one script tag into your site's header on every front-end page. The simplest way is a header scripts plugin; a child theme or Google Tag Manager work just as well. Once the snippet is live, every visitor session on your WordPress site is recorded, and one option masks form inputs when you want them hidden.

Why record sessions on your WordPress site

Page views and bounce rates say that visitors left, not why. WordPress session recording lets you watch the contact form that failed silently, the menu that did not open on a phone, or the pricing table people scrolled past twice. It is useful for blogs, business sites and WooCommerce shops alike, and it complements the analytics you already run. How to see what users do on your website explains where to start.

How to add session replay to WordPress

<script>
(function (w, d) {
  w.anyreplay = w.anyreplay || function () {
    (w.anyreplay.q = w.anyreplay.q || []).push(arguments);
  };
  var s = d.createElement('script');
  s.async = 1;
  s.src = 'https://cdn.anyreplay.com/v1/ar.min.js?k=YOUR_PROJECT_KEY';
  d.head.appendChild(s);
})(window, document);

anyreplay('init', {
  projectKey: 'YOUR_PROJECT_KEY',
  ingestUrl: 'https://in.anyreplay.com',
  // Stop recording after this many sessions in a calendar month.
  // maxSessionsPerMonth: 10000,
  // Form fields are masked: what visitors type replays as asterisks.
  // Passwords, one-time codes and card fields are masked either way.
  // Uncomment the first line to record what visitors type, or the
  // second to hide rich-text editors too.
  // maskAllInputs: false,
  // maskAllTyping: true
});
</script>

1. Option 1: a header scripts plugin

   Install a code snippets or header-scripts plugin such as WPCode, open its site-wide header section, paste the snippet with your key and save. This survives theme changes.

2. Option 2: a child theme

   If you maintain a child theme, hook wp_head in its functions.php and print the snippet, as in the example below. Edit a child theme rather than the parent, or a theme update will remove it.

3. Option 3: Google Tag Manager

   If GTM is already on the site, create a Custom HTML tag with the snippet and trigger it on All Pages, then publish the container.

4. Visit your site

   Open the site in a private window and click through a few pages. The setup page switches to Connected when the first events arrive.

add_action('wp_head', function () {
  ?>
  <!-- Paste the AnyReplay snippet from your project's setup page here -->
  <?php
});

Caching and optimisation plugins that delay, defer or combine JavaScript can hold the snippet back or break its queue. If the setup page stays on waiting, exclude the snippet from those features and clear the cache. Sites on WordPress.com may not be able to add plugins or custom code on every plan; check their help centre. The script tag guide covers the snippet line by line.

Which pages are recorded (and which are not)

Every front-end page that prints the header is recorded: posts, pages, archives, search results and, on WooCommerce, product, cart and checkout pages rendered by your theme. The admin area under /wp-admin is not recorded, because the snippet is only added to the front-end header. Pages built outside the theme, such as a separate landing page tool, need the snippet added there too.

How do I keep customer data out of recordings?

By default every field value replays as asterisks of the same length. If you want comment and contact forms to replay as they were filled in, add maskAllInputs: false to the init options; on a site with WooCommerce checkout or account forms, the default is the safer choice. Some fields are masked whatever you set: passwords and one-time codes, payment card fields, any value of 13 to 19 digits that passes the card-number check, and a half-typed card number past its sixth digit. Email and telephone fields are not among them: they are ordinary fields, masked by default and recorded once you opt out. For personal data printed on the page, such as a name on an account page, add the CSS class ar-mask to that block; in the block editor you can set it under Advanced → Additional CSS class(es). Use ar-block to leave an element out of the recording altogether. See masking.

Consent banners on WordPress

Add requireConsent: true to the init options and AnyReplay records and sends nothing until anyreplay('consent', true) runs. AnyReplay does not store the choice, so call it on every page load for visitors who already agreed. Most consent plugins offer a callback, an event or a script category for this; check your plugin's documentation. With GTM, keep the AnyReplay tag on All Pages and fire a second Custom HTML tag containing the consent call from your consent trigger. See consent and session replay and cookie consent.

Allowed domains

If your project lists allowed domains, AnyReplay checks each request's Origin header against them. Add your live domain, and your staging domain as well if the snippet runs there.

How do I check it is working?

• The project's setup page switches to Connected after the first accepted event.
• In the browser's network panel, requests to in.anyreplay.com should be answered with 202.
• Add debug: true to the init options to log in the console why the recorder is not recording.
• If a security plugin sends a Content Security Policy, allow the AnyReplay hosts as described in Content Security Policy. Otherwise see no sessions.

Frequently asked questions