I have a (test) website with 0 visitors, which is exactly what I want because I use the site as a test ground for my other sites. The site only gets the occasional visit by the bots from Google, but that's it. My robots.txt has excluded everything on the site, so it doesn't show up in online searches.
As I'm thinking of using Hotjar on one of my sites, I installed the Wordpress plugin on my test website and verified it throught the Hotjar website. In my log files, I can see the traffic from the Hotjar site, but much to my surprise I also saw a crap load of other traffic. This traffic comes from all over the world; The United States, Turkey, Netherlands, China, Hong Kong, France, Japan, etc... Most of it is malicious, trying to find backdoors or vulnerable modules. Others are trying to index the sites. This immediately makes the site useless for my testing purposes. And like I said, this started the second after I had installed Hotjar.
Some of the User Agents that are sent are unusual too. "https://about.censys.io/", "Go-http-client/1.1", "python-requests/2.31.0", "Apache-HttpClient/5.1.4 (Java/11.0.18)", etc.
Anyone else using Hotjar and experienced this? I thought Hotjar was benign, but it looks quite malicious now.
