Session recording

If you prefer to pin tracker config in HTML (e.g. multiple sub-domains share the same site ID but only one should record), the data-record="1" attribute on the script tag overrides the server config:

<script defer src="https://api.xictraq.com/t.js"
        data-site="YOUR_SITE_ID"
        data-record="1"></script>
<noscript><img src="https://api.xictraq.com/api/px?s=YOUR_SITE_ID" alt="" width="1" height="1" style="position:absolute;left:-9999px" referrerpolicy="no-referrer-when-downgrade"></noscript>

We recommend the server configuration as the default — it is live-adjustable and applies instantly. There is no JavaScript variable like cfg.rec — configuration runs exclusively via the Settings tab or data-* attributes.

Masking applies in three layers, all at the tracker — sensitive data never even leaves the visitor browser in clear text:

• maskAllInputs — all input fields are masked by default; typed values never reach the recording.
• auto-redaction in text nodes: credit-card numbers (13–19 digits, Luhn-checked) and IBANs are automatically replaced with • — even when they appear as plain text on confirmation or account pages. Deliberately conservative so ordinary numbers/IDs survive.
• opt-in masking: regions marked with data-xictraq-mask or custom CSS selectors (tracker settings) are fully masked. data-xictraq-block excludes an element from recording entirely (blockSelector).

A cron (/cron/tag-recordings) analyses every completed recording via heuristic and attaches tags (session_recordings.tags column, JSON array):

• rage_click — 3+ clicks within 2 s in a 30 px radius of the first click
• dead_click — click without DOM mutation and without page change within 1.5 s (broken buttons / broken onclick)
• error — window.onerror or unhandledrejection during the session — tracker writes it as rrweb custom event into the recording stream so the cron can find it

Tags appear as badges in the recordings list at Analytics → Recordings & Tests.

Even when recording is enabled in the settings, capture does NOT start automatically on load. It waits for the consent signal from your page or consent tool:

xictraq.consent('granted');   // startet Recording (wenn aktiviert)
xictraq.consent('denied');    // stoppt Recording
xictraq.record('start');      // Recording gezielt ein-/ausschalten
xictraq.record('stop');

Only when both activation AND consent are present does the rrweb engine (rx.js) load and capture begin. The recording ID lives in the tab sessionStorage and applies per recording: after 30 minutes without a recorded event (changes to the page count as well) and with the first page load after midnight (UTC), a new recording begins with a new recording ID (from tracker version 61). No cookie; sessionStorage is bound to the tab and the website.

rrweb events are buffered and sent in chunks to /api/p/r — throttled so even long sessions stay lean:

• flush once 60 events are buffered, plus every 10 seconds, plus on pagehide (final chunk; it is omitted after more than 30 minutes without a recorded event) and when the tab goes to the background.
• sampling: mouse moves every 100 ms, scroll every 150 ms, inputs as last value only — cuts volume without losing replay fidelity.
• server-side cap: a single recording file is capped at 10 MB so outliers cannot flood disk. Once the cap is reached, no further recording begins in that tab, not even after a pause or a change of day.
• external stylesheets are inlined into the rrweb snapshot at ingest (same-host only, SSRF-safe) — so replay stays visually correct even after the site redeploys with newly hashed asset URLs.