Visitor Lens

See VisitorLens in action — watch the overview:

VisitorLens is a powerful yet lightweight visitor analytics and session replay plugin built natively for WordPress. Stop guessing why visitors leave and start watching their real journeys — every click, scroll, and mouse movement recorded and replayed directly inside your dashboard.

Whether you run a WooCommerce store, a membership site, or a content blog, VisitorLens gives you the UX data you need to increase conversions and fix friction points — without sending any data to third-party servers.

Why VisitorLens?

Most analytics tools tell you what happened. VisitorLens shows you why. Watch session recordings to discover rage clicks, form drop-offs, confusing navigation, and missed conversion opportunities — then fix them with confidence.

Core Features (Free)

Session Recording & Replay
* Record every visitor session: mouse movements, clicks, scrolls, form interactions
* Replay sessions in a built-in visual player inside your WP admin
* Filter replays by date, duration, page URL, device type, rage clicks, and error count
* Input masking enabled by default — sensitive form fields are never recorded
* Automatic session pruning (configurable retention: 1–90 days)

Visitor Analytics Dashboard
* Real-time visitor count with auto-refresh
* Daily, weekly, and monthly visitor trends (interactive line chart)
* Top pages ranked by page views
* Recent visitor log with location, browser, and device

Statistics Page
* Overview KPIs: total visitors, sessions, page views, bounce rate, avg. session duration
* Pages report: top landing pages, exit pages, most visited URLs
* Audience report: browser breakdown, OS/platform, device type, screen resolution
* Traffic sources: direct, organic, referral, social — with search engine and keyword breakdown
* Real-time active visitors with live page list

Geo-Location
* Country, region, and city detection via ip-api.com (free tier, optional)
* GeoIP lookup can be disabled in Settings → General

Privacy & Consent
* Consent gate: show a banner before recording begins (opt-in or opt-out mode)
* Cookie-based consent persistence with configurable cookie name
* GDPR-compliant: privacy policy content auto-added to WP Privacy Policy page
* Personal data export and erasure via WP Tools → Export/Erase Personal Data
* Honour Do Not Track (DNT) browser signal (optional)
* Exclude logged-in administrators, specific IP ranges, URLs, and user roles

Data Management
* Export sessions as CSV or JSON directly from the Replay page
* Bulk-delete filtered sessions
* Storage usage card in Settings showing DB table sizes
* Configurable automatic cleanup via WP-Cron

Who Is This For?

• eCommerce store owners — find cart abandonment causes, fix checkout friction
• Agency & freelance developers — include analytics in every client site build
• Bloggers & content sites — understand how readers consume content
• SaaS & membership sites — improve onboarding flows and feature discovery
• CRO specialists — validate A/B test hypotheses with real session evidence

Privacy & GDPR

VisitorLens is built with privacy at its core:

• Minimal third-party use — only ip-api.com for optional GeoIP (can be disabled in Settings)
• IP hashing — visitor IPs are hashed with a secret salt by default
• Input masking — form fields are masked and never sent to the server
• Consent tools — built-in opt-in/opt-out consent gate
• Data export & erasure — full WordPress personal data tools integration
• Configurable retention — auto-delete old sessions on a schedule

Performance

• Tracker script: ~4 KB gzipped
• Recorder script: ~9 KB gzipped
• All recording data is batched and sent asynchronously — zero impact on page load scores
• Uses WordPress REST API for all communication — no custom AJAX endpoints
• No external JavaScript libraries loaded on the frontend

Command-line & AI access

VisitorLens keeps every record in your own WordPress database, so you do not need a browser to analyse your visitors. The ReCorp Ops CLI (rc), built by the VisitorLens team, reads VisitorLens data directly and answers in plain text or --json. It is made for AI assistants as much as for humans: hand ChatGPT, Claude, Codex, Gemini, Cursor or any agent that can run shell commands an SSH login to your server plus the rc command, and it can analyse your site’s visitors in seconds — “who is on my site right now”, “which pages lose visitors”, “show me today’s frustrated sessions” — instead of clicking through dashboards.

Connect a site

SSH + WP-CLI — give the rc CLI read access to your site’s database over your own SSH login:
rc sites add-ssh </path/to/wordpress> –host= –port=22 –key=
then rc sites check <alias> to confirm the connection and detect the VisitorLens tables.

Visitor commands

• rc visitors online <site> — visitors active in the last 5 minutes
• rc visitors summary <site> --days=7 — visitors and pageviews per day
• rc visitors recent <site> --limit=50 — latest page views
• rc visitors pages <site> --days=30 — top pages with average load time
• rc visitors sources <site> --days=30 — traffic sources and UTM campaigns
• rc visitors sessions <site> --frustrated — recorded sessions (only rage-click / error sessions with --frustrated)
• rc visitors session <site> <id> --all — one recording as an event timeline (clicks, scrolls, inputs, errors)
• rc visitors visitor <site> <id> — one visitor: device, pages viewed, recordings
• rc visitors tables <site> — VisitorLens tables with approximate row counts
• rc visitors sql <site> "SELECT …" — ad-hoc read-only query ({p} expands to the VisitorLens table prefix; SELECT/SHOW/DESCRIBE/EXPLAIN only)
• rc insights digest <site> --days=7 --json — AI-ready digest: traffic leaks, best landing pages, frustration hot-spots and where to add conversion hooks

Every visitor command is read-only. Add --json for machine-readable output and --limit=n / --days=n to control the window. IP addresses are masked by default; --ip shows them.

A prompt that works

“You have the rc CLI and SSH access to my site <alias>. Run rc visitors summary <alias> --days=7, rc visitors sessions <alias> --frustrated and rc insights digest <alias> --json, then tell me where visitors drop off, which sessions I should watch, and the three fixes to make first.”

External services

This plugin optionally connects to ip-api.com to perform GeoIP lookups (country, region, city) for each tracked visitor.

What is sent: The visitor’s IP address.
When it is sent: On every page-view tracking request, if the GeoIP setting is enabled (Settings → General → GeoIP Lookup). No data is sent if GeoIP is disabled.
Why: To display geographic location of visitors in the analytics dashboard and session list.
Service provider: ip-api.com (ip-api.com)
* Terms of Service: https://ip-api.com/docs/legal
* Privacy Policy: https://ip-api.com/docs/legal

You can disable GeoIP under VisitorLens → Settings → General → GeoIP Lookup at any time.

Privacy Policy

VisitorLens collects the following data about your site visitors when activated:

• Hashed IP address and approximate geographic location (country, city, region)
• Browser, operating system, device type, and screen resolution
• Pages visited, referrer URL, UTM campaign parameters
• Session recordings: mouse movements, clicks, scroll depth (form inputs are masked by default)
• WordPress user ID (only for logged-in users)

All data is stored in your WordPress database. Nothing is sent to external servers.

You are responsible for disclosing your use of session recording technology to your visitors in your site’s Privacy Policy. VisitorLens automatically adds a suggested privacy policy text to your WordPress Privacy Policy page (Settings → Privacy).

1. Upload the visitor-lens folder to /wp-content/plugins/.
2. Activate the plugin through Plugins → Installed Plugins.
3. Navigate to VisitorLens → Dashboard in your admin menu.
4. Visit your site in an incognito/private window (or as a non-admin) to record your first session.
5. Return to VisitorLens → Session Replay to watch it back.

Note: Logged-in administrators are excluded from tracking by default. Test tracking in a private browser window or by temporarily logging out.

1. 

   Dashboard — KPI cards, visitor trend chart, top pages, and live visitor count.

2. 

   Session Replay — Filter and watch recorded visitor sessions in a visual player.

3. 

   Statistics – Overview — Key metrics with trend sparklines and date range selector.

4. 

   Statistics – Audience — Browser, OS, device type, and screen resolution charts.

5. 

   Statistics – Traffic Sources — Referrer breakdown including search engine and keyword data.

6. 

   Settings – General — Configure tracking, recording, exclusions, and sampling rate.

7. 

   Settings – Privacy — Consent gate configuration, DNT, IP hashing, and input masking.

1.0.10

• Improvement: refined the highlighted VisitorLens entry in the admin sidebar menu for a cleaner, more premium look.

1.0.9

• New: added an overview video to the plugin description.

1.0.8

• Maintenance: internal code cleanup and reliability improvements.

1.0.6

• Security: /track and /record public REST endpoints now reject cross-origin forgery attempts (Origin/Referer must match the site) and are rate-limited per IP, preventing anonymous flooding/pollution of visitor and session data. Tracker/recorder scripts retry once instead of dropping data if a request is ever rate-limited.
• Fix: Annotated remaining dynamic-WHERE SQL queries in class-rest-replay.php with explicit prepared-fragment justification comments, consistent with the rest of the codebase (queries were already built from wpdb->prepare()d fragments — no functional change).
• Update: Bundled Chart.js updated from v4.5.0 to v4.5.1.

1.0.2

• Fix: Text domain corrected to visitor-lens throughout all PHP files.
• Fix: Added Domain Path: /languages to plugin header.
• Fix: Sanitized $_GET['vs_replay'] with sanitize_text_field() + wp_unslash().
• Fix: SVG icon output in admin nav now passes through wp_kses() for safe output.
• Fix: Active nav link class attribute now properly escaped with esc_attr().
• New: Added class-privacy.php — GDPR privacy policy content registration, personal data exporter, and personal data eraser.
• Improvement: VSR_VERSION constant now matches plugin header version.

1.0.1

• Fix: Deprecated %f/%d with null values in wpdb::prepare() — lat/lon and screen dimensions now default to 0 instead of null.
• Fix: daily_summary.visitors now only increments for genuinely new unique visitors using $wpdb->rows_affected.
• New: Session export (CSV/JSON) and bulk delete on the Replay page.
• New: Storage usage card in Settings → Data Management.

1.0.0

• Initial release.
• Visitor analytics dashboard with Chart.js line chart.
• Session recording and replay.
• GeoIP location detection (local database).
• Statistics page: overview, pages, audience, traffic sources, real-time.
• Settings: general, privacy/consent, data management.
• REST API: /vsr/v1/track, /vsr/v1/record, /vsr/v1/replay/*, /vsr/v1/stats/*, /vsr/v1/settings.