web design

Heatmaps and Session Recordings: Find Where Visitors Get Stuck

Set up free heatmaps and session recordings with Microsoft Clarity, check consent and masking, spot rage clicks, and fix the one thing costing you calls.

Your analytics says people are arriving. Your phone and your inbox say otherwise. Somewhere between the first screen and the contact form, visitors give up, and nothing in a traffic report tells you where. Heatmaps and session recordings are built for exactly that gap. A heatmap shows where many visitors click and scroll on a page, and a recording replays one visit so you can watch where it stalled. Microsoft Clarity gives you both for free, and you can have it running on your most important page in one sitting. This post walks you through the setup, the privacy checks that come first, what to look for, and how to turn one finding into a fix you can measure.

Key Takeaways

Start with one page

Pick the page where a visitor should call, book, buy or send a form, and watch that page before any other.

Check consent and masking before you record

Clarity masks input boxes and dropdown menus by default, and masking is separate from consent, so confirm both on a real recording.

Read patterns, not single clips

Rage clicks, dead clicks, quick backs and low scroll depth are leads to test, and mobile and desktop need separate reviews.

Fix one thing and measure the outcome

Change one obstacle, then compare calls, forms or bookings for the same page and audience in GA4 or your own records.

Heatmaps and session recordings show you where visitors stall

Think of the two tools as a wide view and a close view. A heatmap adds up many visits. Microsoft Clarity's heatmaps include click maps that show where visitors click, scroll maps that show how far they get, and attention maps that show which regions get the most interaction. A session recording shows a single visit, one at a time.

A recording is not a video of a person. Microsoft describes it as a reconstruction of the page and the visitor's actions, built from clicks, taps, mouse movement, scrolling, page-to-page movement and page visits, as explained in the Clarity overview. You watch a replay of what the page did and what the visitor did to it.

A good rule for choosing between them: when your question starts with "where do visitors usually click or stop," open the heatmap. When it starts with "what happened on that one visit that ended at the contact form," open a recording. Use the heatmap to find the pattern, then use recordings to see the pattern happen.

A pale wooden desk with a closed laptop and three blank index cards fanned out beside a pencil, ready for a page-by-page plan.
Choose one page to watch first, the one where a visit should turn into a call or a form.

You can install Clarity on one page in a single sitting

Clarity is free, and Microsoft says no paid upgrade is required. The Clarity setup page lays out the steps in order:

  1. Create a free Clarity account and a project for your website.
  2. Open the project and go to Settings > Setup.
  3. Add the tracking code in the way that fits your site: through a supported platform integration, by pasting it into the `<head>` of your pages, or through NPM.
  4. Load your own site and confirm Clarity shows the visit.

If your site runs on a platform with a Clarity integration, use it. If a developer manages your site, send them the project's tracking code and tell them which pages matter most. Put the code on every template for the pages you care about, since a page without the code produces no heatmap and no recordings.

Before you invite real visitors into the tool, take a few minutes on the privacy side. That check is next, because masking and consent are easier to set up before the first recording than to repair afterward.

Recording visits touches personal data, so two questions come before any watching. What does the tool hide, and does your cookie setup match how the tool works? Neither answer depends on the other, and neither one replaces the other.

Confirm what Clarity masks

Clarity masks sensitive content by default, and its masking documentation says input boxes and dropdown menus stay masked in every mode. Masked data is not uploaded to Clarity. One timing detail matters: a masking change applies to new recordings, and past recordings stay as they were.

So, do the check on a real recording. Submit a test through your quote form, appointment form, login or checkout, then open that recording in Clarity and look at every field. Names, email addresses, phone numbers, messages, account numbers, health details and payment information should all be hidden. If something on your own pages shows up that should not, add masking for that element and test again.

Clarity uses first-party cookies, named `_clck` and `_clsk`, to connect page views into one session, as listed on the Clarity cookies page. Microsoft says valid consent is required for full functionality for visitors in the European Economic Area, the United Kingdom and Switzerland, and that Clarity has enforced consent signals for those visitors since October 31, 2025. A cookie banner by itself does not satisfy that. The visitor's choice has to be passed to Clarity through its Consent API, a supported consent-management platform or another supported integration, covered in the consent management guide.

Who sets the privacy rules for a recording
SourceWhat it saysWhat you do
Microsoft ClarityValid consent is required for full functionality for EEA, UK and Swiss visitors, and the choice must reach ClarityConnect your banner or consent platform to Clarity and test accept, decline and change-your-mind
UK Information Commissioner's OfficeAnalytics cookies generally need clear information and consent in the UKName analytics and recordings in your cookie notice if you have UK visitors
California Attorney GeneralCovered businesses must honor Global Privacy Control as an opt-out of sale or sharingTurn on Global Privacy Control in a browser and see how your site responds
Colorado Attorney GeneralGlobal Privacy Control is a valid universal opt-out for covered businessesSame test, for visitors in Colorado
Connecticut Attorney GeneralCovered controllers must honor opt-out preference signals from January 1, 2025Same test, for visitors in Connecticut
SourceMicrosoft Clarity
What it saysValid consent is required for full functionality for EEA, UK and Swiss visitors, and the choice must reach Clarity
What you doConnect your banner or consent platform to Clarity and test accept, decline and change-your-mind
SourceUK Information Commissioner's Office
What it saysAnalytics cookies generally need clear information and consent in the UK
What you doName analytics and recordings in your cookie notice if you have UK visitors
SourceCalifornia Attorney General
What it saysCovered businesses must honor Global Privacy Control as an opt-out of sale or sharing
What you doTurn on Global Privacy Control in a browser and see how your site responds
SourceColorado Attorney General
What it saysGlobal Privacy Control is a valid universal opt-out for covered businesses
What you doSame test, for visitors in Colorado
SourceConnecticut Attorney General
What it saysCovered controllers must honor opt-out preference signals from January 1, 2025
What you doSame test, for visitors in Connecticut

Masking limits what Clarity stores. Consent, disclosure and opt-out handling are separate steps, and the rules differ by where your visitors live and what your business collects. Read the ICO's cookie guidance if you serve the UK, and the state pages for California, Colorado and Connecticut if you serve those states. Global Privacy Control covers opt-outs; it does not replace every consent requirement. For the exact rules where your customers live, confirm with qualified counsel. Our posts on the Connecticut Data Privacy Act and on whether your website needs a privacy policy cover the neighboring ground.

A kraft folder with a small brass padlock closed on its clasp, sitting on a clean desk beside an empty glass of water.
Settle masking and consent first, then let the first real recording arrive.

Ten minutes in a private window will tell you if your setup is ready

You do not need a lawyer or a developer to run this first check. Open your site in a private browser window and work through it.

  • Look at the banner. Does it name analytics or recordings in plain words? Can a visitor decline or manage choices, and does declining work?
  • Test an opt-out signal. Turn on Global Privacy Control in a browser that supports it and reload. Check how your site and your consent tool respond for the places you serve.
  • Walk your forms. Fill in your contact form, quote form and any login or checkout with test entries.
  • Open that recording in Clarity. Confirm each field you typed into is hidden.
  • Look for strays. Check hidden fields, account areas, order details and message boxes for anything personal that is visible.

If anything on that list fails, fix it before you review other visitors' sessions. Then move on to the part that finds your lost customers.

Rage clicks, dead clicks and quick backs point to the problem

Start with the pages that earn you money: the homepage, your service pages, the contact and booking pages, checkout, and any landing page you send ad traffic to. Clarity names four behaviors that deserve a closer look, defined on its FAQ page:

Behaviors Clarity flags, and what to check
BehaviorHow Clarity defines itWhat to check
Rage clicksRepeated clicks that suggest frustrationIs the element supposed to be a button or link, and does it respond?
Dead clicksClicks where Clarity detects no responseDoes the thing look clickable, like a heading, image or phone number, without being one?
Excessive scrollingUnusually fast scrollingIs the visitor hunting for something the page does not make easy to find?
Quick backsA rapid return to the previous pageDid the page match what the visitor expected when they arrived?
BehaviorRage clicks
How Clarity defines itRepeated clicks that suggest frustration
What to checkIs the element supposed to be a button or link, and does it respond?
BehaviorDead clicks
How Clarity defines itClicks where Clarity detects no response
What to checkDoes the thing look clickable, like a heading, image or phone number, without being one?
BehaviorExcessive scrolling
How Clarity defines itUnusually fast scrolling
What to checkIs the visitor hunting for something the page does not make easy to find?
BehaviorQuick backs
How Clarity defines itA rapid return to the previous page
What to checkDid the page match what the visitor expected when they arrived?

In recordings, also watch for visitors who hesitate in a form, hit a validation error, or leave right after an important click, as the session list lets you filter and sort. On the heatmap side, the scroll map shows the percentage of visitors who reach each point of a page, which tells you whether your phone number or call-to-action button sits where most visitors never get to.

Review mobile and desktop separately, because the same page lays out differently and the same button can sit in a different place. A hot area on a heatmap means more interaction. It does not mean the visitor was pleased or that the element helps you. A logo, a phone number or a decorative image can all attract clicks for reasons unrelated to your goals.

Look for the same behavior across several recordings before you treat it as real. One odd session is a story. The same stall repeated on the same page is a pattern.

A worn brass doorbell button on a painted wooden door frame, the paint around it slightly rubbed away.
Repeated presses on one spot are a signal worth looking into, not yet a verdict.

Treat each pattern as a test and change one thing at a time

A repeated behavior is a hypothesis about your page. Your job is to reproduce it, change one thing, and see whether the outcome moved. Use these as starting points:

  • Visitors keep clicking a heading. Check whether its styling looks like a link. Restyle it, or make it a real link to where visitors expect to land.
  • Visitors leave before a form. Try shorter copy above the form, clearer expectations about what happens next, fewer fields, or a visible phone number as another way in.
  • Mobile visitors never reach your button. Move it higher or restyle it in the mobile layout.
  • A recording shows an error. Reproduce it on the same device, browser, page and path before you touch anything.

Write down the problem, the page, the device group, the change you plan to make and the result that would count as success, such as a completed form, a booked appointment, a phone call or a purchase. After you publish the change, compare the same page and the same kind of visitor before and after.

Clarity shows you the behavior. Calls, forms, bookings and sales come from your other records: GA4, your booking system, your CRM or your call log. Our post on tracking contact form leads in Google Analytics shows how to count form completions as key events, and the GA4 setup post covers the basics if you have not installed it. Google's help page on A/B tests explains the idea of comparing variants against a defined goal, such as click-through or key-event rate.

If visitors are arriving and not converting, these posts pair well with this one: website traffic but no sales or leads, signs your website is costing you customers, what a good website conversion rate looks like, and how to tell if your site works on a phone. When a bounce rate number is what first worried you, what a good bounce rate means helps you read that number, and the afternoon website check gives you a wider routine.

A pencil lying across a blank lined checklist pad beside a kitchen timer set on a wooden table.
Fix one obstacle, give it a fair stretch of time, then look at the same numbers again.

Set a few limits so you do not watch recordings forever

Several worries are not worth your time. You do not need a universal "right" scroll depth, a target number of recordings or a set count of rage clicks. A percentage means little without the page's purpose, the device, the traffic source and your conversion goal. You do not need to watch every visitor, either. A repeated pattern on a high-value page is the signal.

Recordings do not stay forever. Clarity keeps recordings for 30 days. Favorited recordings and a random selection can stay up to nine months, and heatmap data can also stay up to nine months, according to the recordings overview. Favorite the clips that show your key finding, and write the notes down in your own file.

Free software still takes work. Installing, connecting consent, checking masking, interpreting what you see, fixing the page and measuring the result all take time. Staff visits and your own testing can also skew the results, so label your test sessions and exclude your own visits where you can.

You can do the install and the first look yourself. Help starts to make sense when consent has to be wired correctly for visitors in several places, when a site has many templates, when forms carry sensitive information, when mobile problems need debugging, or when you cannot yet tell whether a lead came from a form, a call or a booking.

Are you ready to watch your visitors?

Pick an answer to begin.

1. What does a Clarity session recording show?

2. Your cookie banner is live. Is that enough for visitors in the EEA, UK and Switzerland?

3. Several recordings of one service page show visitors clicking a heading that is not a link. What is the best next step?

Frequently Asked Questions About heatmaps and session recordings

What is a heatmap on a website?

A heatmap is a color display of interactions added up across many visits, such as where visitors click, how far they scroll and which parts of a page get the most attention.

Is Microsoft Clarity really free?

Yes. Microsoft describes Clarity as free, with no paid upgrade required. Setup, consent and masking still take your time.

Does Clarity record a video of my visitors?

No. Microsoft says a recording is rebuilt from page information and the visitor's actions, not captured as a video stream.

Does masking cover my privacy obligations?

Masking limits what Clarity stores. Consent, disclosure and opt-out handling are separate steps and depend on where your visitors live. Confirm the rules for your locations with qualified counsel.

What are rage clicks and dead clicks?

Clarity defines rage clicks as repeated clicks that suggest frustration, and dead clicks as clicks where it detects no response. Treat both as places to investigate.

Can a heatmap tell me why visitors do not call?

It shows patterns and possible obstacles. Your call log, forms, bookings or GA4 events show whether a change brought more customers.

The Bottom Line

A page that loses visitors is easier to repair once you can watch it happen. Install Clarity on the page where a visit should become a call or a form, confirm masking on a real recording, connect your consent setup, then look at mobile and desktop sessions on their own. Rage clicks, dead clicks, quick backs and scroll depth point you to where a visit stalls.

The payoff comes from the loop: write down one repeated obstacle, change it, and compare the same page before and after. Each round gives you a fix you can prove, and a better sense of what your visitors need.

If you would like a second set of eyes, Web Leveling can help with the parts that get tricky: connecting consent to Clarity, checking masking across your forms, reading mobile recordings and turning the findings into page changes through our web design work. We work with small and medium businesses across the country and overseas. Contact us with the page that is losing visitors and we can look at it with you.

Terms

Heatmap and recording words in this post

Tap a term to see what it means.

Heatmap. A color display that adds up many visitors' clicks, scrolls or attention on one page.

Session recording. A replay of one visit, rebuilt from the page and the visitor's actions rather than filmed.

Rage click. Repeated clicks that suggest a visitor is frustrated.

Dead click. A click where the tool detects no response.

Masking. Hiding sensitive content, such as form entries, so it is not stored in the recording.

Global Privacy Control. A browser signal that tells a site the visitor opts out of the sale or sharing of their data.