UserProofRecord real visitor sessions with a script tag: what it does and how to use it
UserProof records what real visitors do on your site from one script tag: clicks, scrolling, errors, form steps and where they leave. Field values are never recorded and it sets no cookies. Your coding agent adds the tag during setup. Free covers 5,000 recorded visits a month across 3 sites, with 7 days kept.
We measured the script on November 6, 2026: 26,862 bytes as a file and 8,701 bytes over the wire with gzip. It loads with defer, so it waits for the page to finish parsing.
Jump to: quick picks · what it records · how to use it · keep part of a page out · limits · price · FAQ
Quick picks: what are you doing?
| If you want | Use | Why |
|---|---|---|
| Your coding agent to read visits and hand you one fix | This script tag | Setup adds it for you, then the agent reads the events through MCP tools. |
| A scan before any visitor arrives | The free scan | Setup runs it on your live site. It finds broken elements and needs no traffic. |
| A heatmap, or a survey | Hotjar or Microsoft Clarity | UserProof has no heatmaps and no surveys. |
| To pick between replay tools first | Our ranking of 12 tools | Prices and sources for each, with UserProof on the list. |
What the script records
The script records 14 kinds of event from each visit and sends them in batches every 5 seconds, at most 100 events a batch. You can read every line of it at ingest.getuserproof.com/sdk.js.
| What happened | What is kept |
|---|---|
| Page load and leaving | The address without its query string or hash, page title, referrer, browser and device details, language, time on the page, active time and how far they scrolled. |
| Clicks and taps | Where it landed, which element it was, the first 50 characters of its text, and what the page did next. No response at all marks a dead click. |
| Scrolling, resizing and pointer | How far down they went, the window size, and a summary of pointer movement: a count and a distance, not each move. |
| Navigation | Moves between pages, including the ones a single-page app makes without a reload. |
| Form steps | That a field was entered or left, that a form was submitted or refused. Field values are never recorded. |
| Errors | JavaScript errors and failed promises on the page, with up to 200 characters of the message. |
| Text selection and copy | The selected text, capped at 200 characters. Text in a form field is left out. |
| Three key presses | Find (Ctrl+F or Cmd+F), Escape and copy. No other keys are recorded. |
| Tab visibility | When the visitor switched away and came back. |
From those events, UserProof counts dead clicks, rage clicks, errors on click and slow responses. The counts come from the events, never from an LLM. Your coding agent writes the explanation and the fix.
How to use it
- Start setup in your site's project folder. Paste the command from the Claude Code setup page. Done looks like the setup skill running in your terminal.
- Let the agent place the tag. It adds this line to your site's
<head>, in the layout file your framework uses:
Done looks like one new line in the diff, with your site's id in it. No build step or package is added.<script defer src="https://ingest.getuserproof.com/sdk.js" data-site="YOUR_SITE_ID"></script> - Prove it records. The agent opens your local dev server, clicks something and waits for the first event. Done looks like a
receivedstatus from UserProof, and the agent says where the proof came from. - Deploy. The tag only sees real visitors once it is live. Done looks like the line in your production HTML.
- Ask for the top fix. Once visitors have arrived, ask your agent “what should I work on?”. Done looks like one fix with the file and line. After you ship it, UserProof checks whether your goal moved.
Keep part of a page out
Add data-exclude to any element. Inside it, clicks keep their position and element but the text reads [masked], and text selections, copies, mouse movement and form-field events are not recorded. To exclude areas from one place, put selectors in the script tag's own data-exclude attribute. Password fields are always masked. We run the recorder on our own pages, and our funnel calculator keeps its form and results out this way, because the step names you type there are yours.
Limits, stated plainly
- It stores events, not a video of the screen. There are no pixels and no copy of your page's DOM, so it can't show what a page looked like at that moment. If you need that, a DOM replay tool fits better.
- No cookies, but it does store two ids. A random visitor id sits in
localStorageand a session id insessionStorage. A session ends after 30 minutes idle. Check your own consent rules with that in mind. - Most bots are dropped, not all. Bots that announce themselves or run as automated browsers are dropped before they count. Bots that pass as people can use allowance until we filter them out. Visits from your dev server are kept apart from real ones.
- Rich-text editors need
data-exclude. Field values are never recorded, but a click keeps the first 50 characters of the clicked element's text, and in a rich-text editor that text is what the visitor wrote. Mark those editors, and error messages that could carry personal data are worth a look too. - Past your plan's limit, 1 in 4 visitors keeps being recorded until the month resets. Nothing breaks on your site.
- Recordings are kept 7 days on Free and 90 days on Pro and Scale. Findings and the sessions that prove them stay with the finding.
- It needs a site you can add a script tag to, and an agent that runs MCP servers: Claude Code, Codex, Cursor or another.
Price
| Plan | Price | Recorded visits a month | Sites | Recordings kept |
|---|---|---|---|---|
| Free | $0 | 5,000 | 3 | 7 days |
| Pro | $29 a month | 50,000 | Unlimited | 90 days |
| Scale | $99 a month | 250,000 | Unlimited | 90 days |
Read from our pricing page and plan code on November 6, 2026. Visits are pooled across your sites. To compare that with other tools at your volume, use the session replay cost calculator.
Set up UserProof from the home page
FAQ
Does the script tag slow my site down?
It is 8,701 bytes over the wire with gzip, measured November 6, 2026, and it loads with defer, so it does not block the page from parsing. Events go out in batches every 5 seconds.
Does UserProof record what people type?
Field values are never recorded and password fields are always masked. A click keeps the first 50 characters of the clicked element's text, so mark rich-text editors with data-exclude. Text a visitor selects or copies on the page is recorded up to 200 characters.
Do I need a cookie banner for this script?
UserProof sets no cookies. It does keep a random visitor id in localStorage and a session id in sessionStorage, so whether you need consent depends on the rules where your visitors are. Check that for your own site.
Can I add the tag by hand instead of through setup?
You need a site id first, and setup creates it. In practice the agent writes the tag during setup, and it then proves the tag records, which a hand edit would not do.
Sources, read November 6, 2026
- UserProof recording script: sdk.js, read and measured November 6, 2026
- UserProof plans: pricing page and src/lib/plans.mjs, read November 6, 2026
- Setup steps: setup.md and the plugin source, read November 6, 2026