vendor/hotjar · vendor template
Hotjar loaders put the site ID in the path
The published tracking code loads hotjar-{hjid}.js?sv=. hjid is the numeric site ID. in.hotjar.com session traffic is a different surface.
What this pack matches
Rules
Codes are stable. A finding in CI, MCP, or the playground lands on the same id.
| Field | Required | What it checks | Rule ids | Source |
|---|---|---|---|---|
hjid |
required | It is the numeric Hotjar site ID. The published tracking code loads `hotjar-{hjid}.js`. Fix: Copy the tracking code from Hotjar so the path carries your site ID. | vendor.hotjar.param.hjid.missingvendor.hotjar.param.hjid.emptyvendor.hotjar.param.hjid.invalid |
docs |
sv |
recommended | It is the snippet version (`hjsv`) the generated tracking code sends as `sv`. Fix: Keep `sv` from the generated Hotjar snippet. | vendor.hotjar.param.sv.missingvendor.hotjar.param.sv.emptyvendor.hotjar.param.sv.invalid |
docs |
Validate a payload
pixellint validate url "$ARTIFACT" --rulepack vendor/hotjar
Try this failing payload in the playground. Hotjar loader missing site ID.
https://static.hotjar.com/c/hotjar-.js?sv=6
cargo install pixellint
·
npm install pixellint