Website heatmap analysis

What heatmaps and recordings show

A heatmap shows where visitors clicked, tapped and scrolled on a page. A session recording replays one visit. Together they let you see how people use a page, such as which buttons they miss, how far down they read and where they get stuck. We use them to turn a guess about a page into something we can see.

They show what happened. They do not tell you why, and one odd recording proves nothing. That is why we pair them with your analytics and with expert review.

Who it’s for, and when it isn’t

It suits stores that have a page that is not performing and enough visitors on it to see patterns.

It is not the right first step if:

• the page gets very few visits. A heatmap built on a handful of clicks is noise
• you cannot, or do not want to, get consent where it is needed. We will not record people without it
• you do not yet know where sales are lost. Conversion funnel optimisation tells you which page to look at first

What’s included

• Setting up recording on the pages that matter, with consent handled properly
• Masking of forms, account pages and anything personal
• Click, scroll and movement maps for chosen pages, split by phone and computer
• A review of session recordings, chosen to answer a question and not picked at random
• A written report of what we saw, what we think it means and what we would change
• Notes for your privacy policy and cookie banner, to check with whoever advises you on data protection

How we do it

We start with a question. For example, why do people not use the filters, or why do they leave a product page after looking at the images? Recordings with no question behind them are just hours of footage.

We set up with consent in place. Before anything records, we agree how consent works on your store and mask the sensitive parts. See the next section.

We wait for enough visits. A map is only as good as the traffic behind it. We split mobile and desktop, because people behave differently on each, and that halves what we have to work with. If there is too little, we say so and use other evidence.

We read the maps, then watch recordings. The maps point to where something unusual happens. The recordings help us see what it was. We choose recordings on purpose, such as visitors who added to the basket and left, and we do not draw conclusions from one or two.

We write it up. Each finding says what we saw, what we think it means, how sure we are and what we would change. Your funnel data helps us check that a finding matters, and UX research can find out the why by asking people.

Consent and privacy: UK GDPR and PECR in plain English

This is not legal advice, and we are not your lawyers. It is how we approach the rules, so you know what to ask for. Check your own set-up with someone qualified.

Two sets of rules apply. UK GDPR covers personal data, which means anything that identifies a person or could be linked to one. PECR (the Privacy and Electronic Communications Regulations) covers storing or reading information on someone’s device, which is what cookies and similar technologies do.

Consent under PECR. Heatmap and recording tools normally set cookies or use similar technologies. Unless an exemption applies, you need the visitor’s consent before they run, and that means a real choice. The banner should not use pre-ticked boxes, and “reject” should be as easy as “accept”. Since February 2026, the Data (Use and Access) Act 2025 has let cookies used only for statistics run without consent, as long as visitors are told and can object easily. That exception is narrow, and recordings that capture what individual visitors do usually fall outside it.

Lawful basis under UK GDPR. If recordings contain personal data, you need a lawful basis and must tell people what you do. Most stores rely on consent here too, because it fits the PECR consent they already collect.

What we do to keep recordings safe:

• mask all form fields by default, so typed text is never captured
• exclude account, basket and checkout pages unless there is a strong reason, and never record payment details
• run the tool only after consent, and not for visitors who decline
• keep recordings for a short, stated period.
• check the tool’s data location and what its provider does with the data, and list it in your privacy policy.
• treat staff watching recordings as access to personal data, and limit who has it

Your privacy policy and cookie banner should name the tool, say what it does and why, and say how long data is kept. We can write notes for this, and a qualified adviser should check them.

Shopify. Tools added through Shopify’s customer events (an app pixel or a custom pixel) only run once the visitor has given the permissions they need. Scripts pasted straight into the theme don’t get that protection, so we install tools the first way.

If consent rates are low, heatmaps will only cover people who accepted, who may not be typical. We say this in the report.

What it costs

Our pricing page explains how we charge. What changes the price is the number of pages and how long we need to collect data. The heatmap tool has its own cost, which is separate.

We start with an audit. After that, the work runs in sprints (plan, test or implement), each priced and agreed in writing before it starts. See the pricing page.

What we measure

• whether the finding is backed by enough visits, and how many
• whether the pattern appears on both mobile and desktop, or only one
• whether the thing we saw lines up with a drop in the funnel
• after a fix, whether the behaviour changed and whether the page’s conversion measures moved

We report what we saw and how confident we are. We do not present a heatmap as proof that a change will raise sales.

Related

Heatmapping works with conversion funnel optimisation, UX research and A/B testing, which checks whether the fix it suggests helps. It is part of conversion rate optimisation.