What Microsoft Clarity does on your site
Microsoft Clarity is a free behavior analytics service: session recordings, click and scroll heatmaps, a dashboard (popular pages, devices, browsers, countries) and automatic detection of rage clicks, dead clicks and excessive scrolling. Copilot, Microsoft’s AI assistant, summarizes recordings and heatmaps and answers questions about your data.
The official plugin, published by Microsoft, does very little inside WordPress, and that is by design. It adds a Clarity menu that shows the Clarity dashboard in an embedded frame, where you create a project or connect an existing one without leaving the admin area. Once a project is connected, it adds a short script to the head of every public page that loads the Clarity tag asynchronously from www.clarity.ms. There are no other settings: masking, consent, exclusions and filters all live in the Clarity web app, whose labels we quote as they appear there.
Two recent features go further. The first is server-side collection, active as soon as a project is connected: for every public page requested, the plugin stores the IP address, the reported browser and the page URL in a database table, then WP-Cron sends those rows in batches to Microsoft every five minutes. They feed the “Bot Activity” report in the AI Visibility section, which covers bots and AI crawlers. The second, Brand Agents, is a conversational shopping assistant for WooCommerce and WordPress pages; it only appears after you explicitly connect the site to that service.
Which sites Microsoft Clarity is a good fit for
Clarity answers one specific question: what do visitors actually do on a page, and where do they get stuck? It is useful for:
- WooCommerce stores and checkout funnels: recordings show the step where a shopper hesitates, goes back or gives up.
- Landing pages and forms: the scroll map shows how far people read, and dead clicks reveal elements that look like buttons.
- Small teams with no analytics budget: Microsoft describes Clarity as free forever, with no limits on traffic or on the number of sites, projects or members.
- Sites that want to measure AI crawler visits: the Bot Activity report is fed by default when you use the WordPress plugin (see our article on AI bots).
It is not the right choice if you want full audience analytics hosted on your own server: Matomo keeps the data on your server, while Clarity sends it to Microsoft. It is also a poor fit if you have no cookie banner: without consent, Clarity runs in a reduced mode for European visitors.
Microsoft Clarity strengths and limitations
Strengths
- Completely free. Recordings, heatmaps and Copilot with no paid plan and no announced traffic cap.
- Setup in a few clicks. Create or connect the project from WordPress, without pasting code into your theme.
- Masking by default. Balanced mode masks numbers and email addresses, and input fields and dropdowns are masked in every mode.
- Consent handled on the Clarity side. Consent Mode, the consentv2 API, Google Consent Mode and a native CookieYes integration.
Limitations
- Data kept for 30 days. Recordings are kept for 30 days; only favorites and a random sample are retained for up to 9 months.
- No settings in WordPress. No way to exclude administrators or choose which pages are tracked: you have to block your IP address in Clarity.
- Server-side collection outside the banner. The logs sent for Bot Activity (IP, browser, URL) leave from WordPress and do not depend on cookie consent.
- Reduced mode without consent. In the EEA, the UK and Switzerland, every page view becomes a session and funnels show a full drop-off.
- Capped heatmaps. A heatmap covers at most 100,000 page views.
The settings we recommend for Microsoft Clarity
The only WordPress-side setting is the connected project. Everything else happens in the Clarity app, under the project’s “Settings”; only project admins can change masking and IP blocking.
| Setting | Recommended value | Why |
|---|---|---|
| Clarity project Clarity menu in WordPress | One project per site | Mixing several sites in one project skews heatmaps and dashboards. |
| Masking mode Clarity > Settings > Masking | Balanced (default), Strict if your pages show personal data | Strict masks all text, which helps on a customer area or an intranet. |
| Mask by element Clarity > Settings > Masking | CSS selectors of sensitive areas | For example, masks the address block on the WooCommerce My account page without switching the whole site to Strict. |
| Consent Mode Clarity > Settings > Setup | Cookies off by default | Clarity then waits for your banner’s signal before setting _clck and _clsk, for all visitors. |
| Consent signal Your cookie banner | Clarity filed under analytics, denied by default | The analytics_storage signal turns on tracking, ad_storage turns on sharing with Microsoft Ads: grant it only with genuine advertising consent. |
| IP blocking Clarity > Settings > IP blocking | Your team’s fixed IPv4 addresses | The plugin also tracks logged-in administrators; IPv6 and dynamic addresses are not supported. |
| Automatic updates Plugins > Installed Plugins | On | Microsoft often ships small fix releases, some of them security fixes. |
- In a private window, decline cookies, then check in the browser tools that
_clckand_clskdo not appear. - In the console, the check command from the Clarity documentation should show
analytics_storage: "DENIED"before your choice and"GRANTED"after you accept. - Add Clarity and the server-side collection (IP address, browser, page) to your privacy policy and your records of processing (see GDPR, logs and IP addresses).
- Watch a recording of a checkout or form page: no typed input should be readable.
Security of the Microsoft Clarity plugin
Two vulnerabilities have been published, both fixed long ago:
- CVE-2024-0590, fixed in 0.9.4: with no CSRF check when saving the project ID, an attacker could get the project changed and inject JavaScript if an administrator clicked a crafted link (CVSS 6.1).
- CVE-2021-33850, version 0.3: stored XSS on the project ID configuration page, fixed in 0.4.
The main risk comes from what the plugin does: it adds a script to every page and decides which project receives the data, so staying on the latest version matters (see our guide to automatic plugin updates). Since version 0.9.3, only an administrator can change the connected project, but the Clarity menu stays visible to any account that can write posts. WP Masquerade Pro renames the plugin folder in public URLs; the tag loaded from www.clarity.ms and the clarity JavaScript object remain visible, as on any site measured with Clarity.
What WP Masquerade hides for Microsoft Clarity
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Microsoft Clarity: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
Nothing more
Still visible
- JavaScript variables
clarity - files served by the vendor
www.clarity.ms
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Microsoft Clarity FAQ
Is Microsoft Clarity really free?
Yes. The official FAQ describes Clarity as a free service forever, with no traffic limits and no need to upgrade to a paid version. The number of sites, projects and members is not limited.
Do I need a cookie banner to use Clarity?
For visitors from the EEA, the UK and Switzerland, yes: since October 31, 2025, Clarity requires a valid consent signal to work fully. A banner such as CookieYes, which is natively integrated, passes that signal; otherwise your banner must call the consentv2 API or use Google Consent Mode.
Does Clarity slow down my site?
Microsoft says it does not, and the script added by the plugin loads the tag asynchronously, without blocking rendering. Still, measure your key pages before and after activation.
Can I use Clarity with Google Analytics?
Yes. Clarity offers a Google Analytics integration that creates a custom dimension holding the link to each session’s recording. The numbers in the two tools never match exactly.
What happens when I uninstall the plugin?
The tag disappears from your pages and the plugin deletes its options, including the project ID. The project itself stays in your Clarity account: delete it from the app if you no longer need it.