FAQ

Is Jarhead free?

Yes. One edition, everything switched on, no licence key and no licensing code in the plugin. You still need a Hotjar account; Hotjar's own pricing is between you and them.

Do I need to change my templates?

No. Every front-end HTML page gets the tracking code spliced in before </head> automatically. If you would rather place it yourself, turn off autoInject and use {{ craft.jarhead.snippet }} — which also stands automatic injection down for that page, so you can do it on one template without touching the setting.

Why not just paste the snippet into my layout?

You can, and for a single-site, single-environment marketing page that is genuinely enough — it is what Hotjar's own installer tells you to do.

Jarhead exists for the day after: the recordings that are your own team, the staging data landing in the production Hotjar account, the consent gate somebody asks for, and the recordings nobody can filter because nothing sends attributes.

Does it change Hotjar's tracking code?

No. The snippet is emitted character for character as Hotjar publishes it — same formatting, same identifiers — with exactly three departures: hjid and hjsv come from your settings, and one line sets a CSP nonce when you have configured one.

That is deliberate. The snippet is the documented integration surface, Hotjar's own support will ask you to compare it against theirs, and a plugin that tidies it up is a plugin whose bug reports all close as "not our code". Jarhead changes what runs around the snippet.

Does it work with a full-page cache?

Yes, and that constraint is what the whole design is built around.

Anything that varies per request — Craft site, environment, URI, signed-in state, user group — is decided on the server, once, before anything is emitted. Anything that varies per visitor — consent, Do Not Track, Global Privacy Control, an automated browser — is decided in the browser.

Deciding consent on the server would mean the HTML is no longer the same for every visitor, so either the page cache is defeated or one visitor's answer is cached and served to the next. The second one is worse than having no gate at all.

Is it GDPR compliant?

Compliance is a property of your site and your processes, not of a plugin — so no plugin can honestly answer yes on your behalf. What Jarhead gives you is the mechanism:

Under a consent gate, nothing reaches Hotjar until the visitor agrees — no script element, no request to static.hotjar.com, no _hjSettings. Not a blocked script and not a deferred one: the tracking code is created by the gate, in the browser, after consent. That is the behaviour a privacy review actually asks for.

Do Not Track and Global Privacy Control are honoured on top of whichever gate you choose, and a refusal beats consent — consenting does not override a visitor's DNT.

Which consent managers does it work with?

Four gates, which between them cover most of what is out there:

Mode	Opens when
cookie	a named cookie exists, optionally holding a named value
event	a DOM event fires on window or document
dataLayer	dataLayer carries analytics_storage: 'granted' — Google Consent Mode v2
manual	your code calls window.jarhead.consent()

If your consent manager writes a cookie, you need no code at all.

Does it track the control panel?

Never, and there is no setting for it. A session recorder pointed at the control panel records other people's addresses, order histories and account details. That is a data breach with a subscription.

What does it send to Hotjar about my users?

Only what you switch on, and never an email address or a username — there is no setting anywhere that sends either.

The automatic attributes are facts about the page: site handle, section, entry type, template, language, environment, whether the visitor was signed in, and their first user group. Sending the Craft user ID as Hotjar's userId is opt-in and HMAC'd with your security key by default, because an identifier only has to be stable to be useful — it does not have to be readable.

Does Jarhead store anything?

No. No database tables, no counters, no log of who was tracked. Hotjar is the thing collecting the data; a shadow copy in Craft would be a second privacy problem added to solve the first.

Can I use a different Hotjar account per environment?

Yes — that is what the Site ID being environment-aware is for:

'siteIds' => ['default' => '$HOTJAR_SITE_ID'],
'allowedEnvironments' => ['production'],

Set the variable to a different ID on staging, or leave it unset there and Jarhead reads it as "not configured here" rather than as a literal string.

Does it slow the page down?

The gate is a few kilobytes of inline JavaScript with no dependencies and no network request of its own. Hotjar's script is loaded asynchronously, exactly as Hotjar's own snippet loads it.

Injection rewrites the prepared response body once per request and restamps content-length. If anything goes wrong it is caught and logged — analytics is never worth taking a page down for.

Does it support single-page apps?

Yes. Turn on spaSupport and route changes via history.pushState, history.replaceState or the back button are reported with hj('stateChange', …). Without it Hotjar sees one long page view and every heatmap after the first route change lands on the wrong page.

Will it record my Playwright tests?

Not by default. excludeAutomatedBrowsers refuses to run when navigator.webdriver is set, which covers Playwright, Puppeteer, Selenium and most uptime checkers. It is decided in the browser rather than from the user agent, because a user-agent test on the server would vary your page cache.

How do I know it is actually working?

Utilities → Hotjar, or php craft jarhead/verify. It asks Hotjar's CDN for the script belonging to your Site ID and reads the body — Hotjar returns 200 for every numeric ID ever asked for, so a wrong ID looks like success unless something checks properly.

It will also tell you when recording is switched off or sampled down in your Hotjar account, which is the real cause of most "it is installed but there are no recordings" reports.

Which versions are supported?

Craft CMS 5.3+ and PHP 8.2+. No runtime dependencies beyond Craft's own.

Is this an official Hotjar plugin?

No. Jarhead is not affiliated with, endorsed by, or sponsored by Hotjar Ltd. It installs the tracking code Hotjar publishes; everything else is Craft-side.