ClickClue – Session Replay

ClickClue is a session recording and replay plugin for WordPress. Watch consenting, signed-out visits to understand navigation, clicks and scrolling. Bookmark recordings and add review notes. Recordings stay in your WordPress database; no external analytics account is required.

Included in Free

• Session recording and replay with playback controls.
• Page, device, date, watched and bookmarked filters, plus saved filters.
• Bookmarks and review notes to keep useful examples together.
• Visitor consent, masking, page exclusions and private-region controls.
• Configurable sampling, retention and storage budget.

Free has no trial expiry or monthly quota. Consent, sampling, retention, storage and hosting limits apply.

Optional ClickClue Pro add-on

Pro adds grouped clues, click/scroll heatmaps, structural form insights, journeys, before-and-after comparisons, optional feedback and team tools. These paid features are not included in Free. Free replay and privacy controls remain available without Pro.

Compare Free and Pro. See the activation FAQ below.

Privacy

Capture requires visitor permission. Saved masking choices survive upgrades. Images are excluded by default. SVG, canvas, audio, video, embedded frames, hidden inputs and editable content remain excluded. URL query values and fragments are removed, except a verified public WordPress post or page ID needed to distinguish plain permalinks. Structural classes and IDs can remain for layout; use data-tw-block or exclusion selectors around sensitive attributes.

Free does not intentionally collect raw IP addresses, request bodies, console logs, customer IDs or order IDs. Mask or exclude sensitive details in page text or attributes. A rotating keyed IP hash is kept temporarily for rate limiting. Hosting/server logs are outside the plugin’s control.

The built-in prompt saves site-scoped consent for 180 days. Do Not Track and Global Privacy Control prevent recording. Withdrawal stops capture, clears unsent data and requests deletion of the current valid session. Failed deletion remains visibly pending. Older sessions follow retention and administrator deletion. Unfinished requests from older versions can remain unconfirmed with recording off; dismissing that notice does not confirm deletion. Owners should review such requests through their privacy process.

Changing the privacy notice or recording scope can require fresh permission, including image approvals and Pro goals or campaigns. Existing valid refusals remain respected. For an external consent manager, disable the built-in prompt only after wiring window.ClickClue.grantConsent() and window.ClickClue.withdrawConsent(). Consent is still required. Privacy controls alone do not establish legal compliance for an installation.

Approved public images

Off by default. Administrators can approve public, static WordPress images containing no personal or sensitive content. PHP GD and local uploads are required. Bounded PNG/JPEG copies are prepared locally, without arbitrary visitor-URL fetching or screen capture. Private, masked and excluded regions take priority.

The catalogue allows 256 images and about 46 MiB of data/metadata. Each recording allows 64 used copies and 2 MiB within its budget. Unmatched images stay placeholders. Removing approval removes stored copies, preserving other events; downloaded exports need separate review. Update your notice and test first.

Operation

Uploads use acknowledgements, bounded retries and deduplication. Unsent events stay in memory, up to 2 MiB, and clear on withdrawal. Reconnection can resume capture. Oversized snapshots/backlogs stop capture; browser destruction loses pending data. Replay labels interrupted or unconfirmed delivery.

Cleanup uses hourly WP-Cron and bounded dashboard/session cleanup. Low-traffic sites need a real cron trigger for timely retention. Deactivation keeps data. Delete data when uninstalling controls permanent cleanup.

Local guidance and optional previews

Tutorial progress stays in the administrator’s browser. Preview hide/dismiss preferences stay on-site per administrator and support WordPress privacy export/erasure. Selected previews stay in site/account-scoped browser storage for seven days. Previews send no analytics or email signup. Pricing links use fixed fragments without site, user or recording identifiers.

After the site’s first counted recording is 30 days old and an administrator reviews ten distinct recordings across five UTC days, an optional review invitation can appear. Counters started in 1.1.5 and survive updates. Choose an honest review, a 30-day reminder or permanent dismissal per administrator. Counts stay local. Help also has a review link.

Translations and development

Translations use clickclue: site language for visitors, user language for the dashboard, English fallback. The languages/ template is not a complete set of human translations. Clear page caches after changing site language.

Source and a dependency-locked build are included; see BUILD.txt and THIRD-PARTY-LICENSES.txt. The tutorial opens a translated local guide; assets/help.html has an English copy.