Privacy Configuration

Sanitizing individual elements

Add data-private to sanitize an element and its children. Only dimensions are recorded; no inner content or interactions are captured.

<div data-private>
  This data will <strong>not</strong> be recorded.
</div>

Use data-private="delete" to hide an element entirely from playback.

Lorem Ipsum on inputs

For input and textarea, set data-private="lipsum" to render placeholder characters matching the length of the typed text during playback.

<textarea data-private="lipsum"></textarea>

Sanitize all user input fields

Set dom.inputSanitizer to obfuscate all user-input elements. Allowlist specific nodes with data-public. You can also use"lipsum" to simulate typing without capturing real values.

// Obfuscate all user inputs
LogRocket.init(YOUR_APP_ID, {
  dom: {
    inputSanitizer: true,
  },
});

// Replace all user inputs with Lorem Ipsum
LogRocket.init(YOUR_APP_ID, {
  dom: {
    inputSanitizer: "lipsum",
  },
});

// Allowlist a specific field
<input data-public title="this is not private" />

Sanitize all text fields

Set dom.textSanitizer to obfuscate all text nodes. Nodes can be allowlisted with data-public.

LogRocket.init(YOUR_APP_ID, {
  dom: {
    textSanitizer: true,
  },
});

<textarea data-public>This is not private</textarea>

Sanitize by attribute

Use privateAttributeBlocklist to blocklist attributes; matching elements are treated like data-private.

LogRocket.init(YOUR_APP_ID, {
  dom: {
    privateAttributeBlocklist: ['data-hide-this'],
  },
});
// <div data-hide-this></div> will not be recorded

Sanitize by CSS class name

Use privateClassNameBlocklist to exclude elements by class name.

LogRocket.init(YOUR_APP_ID, {
  dom: {
    privateClassNameBlocklist: ['class-hide-this'],
  },
});
// <div class="class-hide-this"></div> will not be recorded

Disable recording specific attributes

Use hiddenAttributes for fine-grained control to exclude specific HTML attributes (name and value) without removing the entire element.

LogRocket.init(YOUR_APP_ID, {
  dom: {
    hiddenAttributes: ['hidden-value'],
  },
});
// <div hidden-value="foo" shown-value="bar"></div>
// will be recorded as <div shown-value="bar"></div>

Disable DOM logging

Set dom.isEnabled to falseto disable all DOM recording. This will make session replay blank for that page, though network requests and console logs will continue to record.

LogRocket.init(YOUR_APP_ID, {
  dom: {
    isEnabled: false,
  },
});

_lr-hide (legacy)

DOM trees with the _lr-hide class are sanitized similar todata-private, but are entirely excluded from visualization. Prefer the newer mechanisms above.

Sanitize a network request

Use requestSanitizer to scrub sensitive data from outgoing requests or to ignore a request/response pair entirely. Return the modified request object, or returnnull to ignore the pair.

// Add this to your existing init call, do not call init twice!
LogRocket.init(YOUR_APP_ID, {
  network: {
    requestSanitizer: (request) => {
      if (request.url.toLowerCase().includes('ignore')) {
        return null; // ignore the request/response pair
      }
      return request;
    },
  },
});

LogRocket.init(YOUR_APP_ID, {
  network: {
    requestSanitizer: (request) => {
      if (request.url.toLowerCase().includes('ignore')) {
        return { ...request, body: null };
      }
      return request;
    },
  },
});

LogRocket.init(YOUR_APP_ID, {
  network: {
    requestSanitizer: (request) => {
      return {
        ...request,
        headers: {
          ...request.headers,
          'x-auth-token': '', // or null to remove
        },
      };
    },
  },
});

Sanitize a network response

Use responseSanitizer to redact sensitive data from responses. Return null to redact all fields and record only timing data.

LogRocket.init(YOUR_APP_ID, {
  network: {
    responseSanitizer: (response) => {
      if (typeof response.body === 'string' && response.body.includes('<field to redact>')) {
        return { ...response, body: undefined };
      }
      return response;
    },
  },
});

// Delete a field entirely
if (response.body?.field_to_delete) {
  return {
    ...response,
    body: {
      ...response.body,
      field_to_delete: undefined,
    },
  };
}

// Obfuscate a field's value
if (response.body?.field_to_hide) {
  return {
    ...response,
    body: {
      ...response.body,
      field_to_hide: '**redacted**',
    },
  };
}
return response;

LogRocket.init(YOUR_APP_ID, {
  network: {
    responseSanitizer: () => null,
  },
});

Disable recording of all network data

Set isEnabled to false to disable network data capture entirely. When possible, prefer sanitizing headers and bodies to maintain timing and error data.

LogRocket.init(YOUR_APP_ID, {
  network: {
    isEnabled: false,
  },
});