shouldiuse.io

Report

Should I Use Hotjar (now Contentsquare)?

hotjar.com·Analyzed 13 hours ago··Based on 12 sources

Contentsquare, the global leader in digital experience analytics, has joined forces with Hotjar, the leading product experience insights platform in the midsize and SMB market.

Worth it

Worth it

Buy if you run an SMB site and want heatmaps, session replay, and surveys free up to 200k sessions/month — signups now go through Contentsquare.

Generous free behavior analytics (200k sessions/mo), now folded into Contentsquare. Great for SMBs; note the 2024 OAuth flaw.

Confidence: Medium

Yes

Free tier

200k sessions/month

10+

Free plan integrations

Plus funnels and error monitoring

3

Public security findings

2021–2024: OAuth flaw + 2 plugin CVEs

Merged

Product status

New signups routed to Contentsquare

Value for money4

200k free sessions/month is genuinely generous

Ease of use4

Drop-in script, heavily documented

Feature depth4

Heatmaps, replay, surveys, funnels, error monitoring

Security posture2

2024 OAuth/XSS takeover flaw; plugin CVEs

Pros

  • Free plan includes heatmaps, session replay, surveys, funnels, error monitoring¹
  • Free plan captures up to 200k sessions per month²
  • 10+ integrations included at no cost²
  • Free-forever tracking, no trial timer³
  • Long-established tool with abundant tutorials and documentation⁵

Cons

  • You can't create a Hotjar account anymore; new users are routed to Contentsquare¹
  • Hotjar's free plan historically limited features and data collection⁴
  • 2024 OAuth+XSS flaw enabled account takeover via malicious links⁶
  • WordPress plugin had stored XSS through v1.0.15⁹

Gotchas

  • highJuly 2024 OAuth+XSS flaw let attackers steal credentials from users clicking malicious links⁷
  • mediumNew signups land on Contentsquare, not Hotjar — expect brand and plan changes mid-journey¹
  • mediumHotjar's free plan offered restricted data collection; scaling meant fast upgrade pressure⁴
  • mediumGuess: session replay records real user input — verify consent/PII masking against GDPR before installing12

Best for

  • SMB product and marketing teams
  • Landing-page conversion optimization
  • Budget UX research on the free tier
  • Sites under 200k monthly sessions

Not for

  • Anyone wanting standalone Hotjar — new accounts are forced onto Contentsquare
  • Security-strict orgs — 2024 OAuth/XSS account-takeover flaw is a red flag
  • Privacy-tight teams uncomfortable recording real user sessions
  • Buyers who need published, predictable paid pricing — tiers aren't shown

Companies that use it

  • Seer Interactive⁵

Pricing

Free

$0

  • 200k sessions/month
  • Heatmaps, session replay, surveys
  • Funnels, error monitoring, 10+ integrations

Paid plans

Not disclosed

  • Higher session volumes
  • Reviewers report free tier limits push upgrades

Security

A 2024 OAuth+XSS account-takeover flaw and two WordPress plugin XSS CVEs; no active breach reported.

  • OAuth + XSS account takeover (July 2024)Attackers could steal OAuth credentials via legitimate-looking malicious links; ~1M sites using such tools faced credential leakage risk.⁶
  • CVE-2021-24301: Hotjar Connecticator WP pluginStored Cross-Site Scripting in the 'hotjar script' textarea through plugin v1.1.1.⁸
  • GHSA-q7vg-v528-qjwj: WordPress plugin stored XSSStored XSS via hotjar_site_id in versions up to and including 1.0.15.⁹

What users say

Independent comparisons praise the free entry point but flag the free plan's data limits as a scaling constraint.

“The lesson from the Hotjar vulnerability: HTTP-Only (XSS protection) is not effective if you have OAuth”
— Reddit, r/PHP

Alternatives

Compare Hotjar (now Contentsquare) with each alternative.

Full analysis

Based on 12 public sources; pricing beyond the free tier not disclosed in evidence.

Sources

  1. Official Hotjar Site – Sign up for freecontentsquare.com
    official
  2. Contentsquare homepagecontentsquare.com
    official
  3. Free Website Visitor Tracking Toolhotjar.com
    official
  4. Hotjar Pricing in 2026 – UXtweakblog.uxtweak.com
    review
  5. How Hotjar Works – Seer Interactiveseerinteractive.com
    review
  6. Hotjar's OAuth+XSS Flaw – Indusfacedocs.indusface.com
    security
  7. XSS Vulnerability Tied to Hotjar – Salt Securitysalt.security
    security
  8. CVE-2021-24301: Hotjar Connecticatorcve.imfht.com
    security
  9. GHSA-q7vg-v528-qjwj WordPress plugin advisorygithub.com
    security
  10. Hotjar Security Rating – UpGuardupguard.com
    security
  11. Reddit r/PHP – Hotjar vulnerability lessonreddit.com
    security
  12. Hotjar Security FAQshelp.hotjar.com
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Ask a follow-up

Ask if a use case fits. Answers stay inside this report and its sources.

    Comments

    One queue. No replies. Give a display name first. Limit: 7 comments per day.

    Save a name to write a comment.

    No comments yet.