shouldiuse.io

Categories

VERDICT

Hotjar (now Contentsquare) Review

Worth it

Should I use Hotjar (now Contentsquare)?

Contentsquare, the global leader in digital experience analytics, has joined forces with Hotjar, the leading product experience insights platform in the midsize and SMB market. - hotjar.com

· 1 month ago

Buy if you run an SMB site and want heatmaps, session replay, and surveys free up to 200k sessions/month — signups now go through Contentsquare. Skip it if you need hardened auth or standalone Hotjar; a 2024 OAuth flaw and forced brand migration add friction.

Confidence

Medium. Based on 12 public sources; pricing beyond the free tier not disclosed in evidence.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence in sources
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Paid plansNot disclosed in sources

Best for

  • SMB product and marketing teams
  • Landing-page conversion optimization
  • Budget UX research on the free tier
  • Sites under 200k monthly sessions

Not for

  • Anyone wanting standalone Hotjar — new accounts are forced onto Contentsquare
  • Security-strict orgs — 2024 OAuth/XSS account-takeover flaw is a red flag
  • Privacy-tight teams uncomfortable recording real user sessions
  • Buyers who need published, predictable paid pricing — tiers aren't shown

Gotchas - check before you buy

high

July 2024 OAuth+XSS flaw let attackers steal credentials from users clicking malicious links

medium

New signups land on Contentsquare, not Hotjar — expect brand and plan changes mid-journey

medium

Hotjar's free plan offered restricted data collection; scaling meant fast upgrade pressure

medium

Guess: session replay records real user input — verify consent/PII masking against GDPR before installing

Pros and cons

Pros

  • Free plan includes heatmaps, session replay, surveys, funnels, error monitoring
  • Free plan captures up to 200k sessions per month
  • 10+ integrations included at no cost
  • Free-forever tracking, no trial timer
  • Long-established tool with abundant tutorials and documentation

Cons

  • You can't create a Hotjar account anymore; new users are routed to Contentsquare
  • Hotjar's free plan historically limited features and data collection
  • 2024 OAuth+XSS flaw enabled account takeover via malicious links
  • WordPress plugin had stored XSS through v1.0.15

Sources & method

- 12 sources - A 2024 OAuth+XSS account-takeover flaw and two WordPress plugin XSS CVEs; no active breach reported.

official x4review x2security x6
  • OAuth + XSS account takeover (July 2024), Attackers could steal OAuth credentials via legitimate-looking malicious links; ~1M sites using such tools faced credential leakage risk.
  • CVE-2021-24301: Hotjar Connecticator WP plugin, Stored Cross-Site Scripting in the 'hotjar script' textarea through plugin v1.1.1.
  • GHSA-q7vg-v528-qjwj: WordPress plugin stored XSS, Stored XSS via hotjar_site_id in versions up to and including 1.0.15.

Key stats

  • Value for money: 4/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 4/5. 200k free sessions/month is genuinely generous
  • Ease of use: 4/5. Drop-in script, heavily documented
  • Feature depth: 4/5. Heatmaps, replay, surveys, funnels, error monitoring
  • Support quality. No support evidence in sources
  • Security posture: 2/5. 2024 OAuth/XSS takeover flaw; plugin CVEs
  • Yes Free tier 200k sessions/month
  • 10+ Free plan integrations Plus funnels and error monitoring
  • 3 Public security findings 2021–2024: OAuth flaw + 2 plugin CVEs
  • Merged Product status New signups routed to Contentsquare

Pricing

Free

$0

  • 200k sessions/month
  • Heatmaps, session replay, surveys
  • Funnels, error monitoring, 10+ integrations

Paid plans

Not disclosed

  • Higher session volumes
  • Reviewers report free tier limits push upgrades

Security

A 2024 OAuth+XSS account-takeover flaw and two WordPress plugin XSS CVEs; no active breach reported.

  • OAuth + XSS account takeover (July 2024)Attackers could steal OAuth credentials via legitimate-looking malicious links; ~1M sites using such tools faced credential leakage risk.⁶
  • CVE-2021-24301: Hotjar Connecticator WP pluginStored Cross-Site Scripting in the 'hotjar script' textarea through plugin v1.1.1.⁸
  • GHSA-q7vg-v528-qjwj: WordPress plugin stored XSSStored XSS via hotjar_site_id in versions up to and including 1.0.15.⁹

What users say

Independent comparisons praise the free entry point but flag the free plan's data limits as a scaling constraint.

“The lesson from the Hotjar vulnerability: HTTP-Only (XSS protection) is not effective if you have OAuth”
Reddit, r/PHP

Companies that use it

  • Seer Interactive⁵
Full analysis

Based on 12 public sources; pricing beyond the free tier not disclosed in evidence.

Generous free behavior analytics (200k sessions/mo), now folded into Contentsquare. Great for SMBs; note the 2024 OAuth flaw.

Methodology

Based on 12 public sources; pricing beyond the free tier not disclosed in evidence.

Read how a report is made.

Sources

  1. Official Hotjar Site – Sign up for freecontentsquare.com
    official
  2. Contentsquare homepagecontentsquare.com
    official
  3. Free Website Visitor Tracking Toolhotjar.com
    official
  4. Hotjar Pricing in 2026 – UXtweakblog.uxtweak.com
    review
  5. How Hotjar Works – Seer Interactiveseerinteractive.com
    review
  6. Hotjar's OAuth+XSS Flaw – Indusfacedocs.indusface.com
    security
  7. XSS Vulnerability Tied to Hotjar – Salt Securitysalt.security
    security
  8. CVE-2021-24301: Hotjar Connecticatorcve.imfht.com
    security
  9. GHSA-q7vg-v528-qjwj WordPress plugin advisorygithub.com
    security
  10. Hotjar Security Rating – UpGuardupguard.com
    security
  11. Reddit r/PHP – Hotjar vulnerability lessonreddit.com
    security
  12. Hotjar Security FAQshelp.hotjar.com
    official

Add this review to your site

Hotjar (now Contentsquare) earned a Worth it check.

Put the badge on your site, pricing page, or docs.

Visitors see an independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Worth it Hotjar (now Contentsquare) Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.