The bug, captured by the person who saw it

The plugin draws the chosen section into an image, directly in the visitor’s browser, from the content of the page and the styles applied to it. It is not a pixel-perfect screenshot: a font or an image hosted on another domain that forbids cross-origin access may be missing. The report always carries the URL of the page, the CSS selector and the position of the section, so that you find the element again even if the image is incomplete.

A capture reproduces the page as it is displayed, form fields included: what a visitor typed into a field is part of the image. Glitchpin, in its free version, offers no way to mask part of a capture, neither automatically nor by hand. Automatic masking of passwords, card numbers and one-time codes, the data-octoscope-private and data-octoscope-ignore markers, the "mask every form field" option and manual black-out in the annotation editor are features of Glitchpin Pro. If your pages display personal data, take that into account before enabling the widget there.

For every report: the URL and the title of the page, the context of your own site (WordPress version, environment, theme, PHP version), and that of the browser: name and major version, operating system, device type, screen size, pixel density, orientation, language, time zone, scroll position, and the referrer only when it comes from your site. No digital fingerprint is computed: no canvas, no font list, no plugin list, no hardware probing. The IP address is never stored in clear text: only a salted hash is kept, in order to apply the rate limit. An email address is stored only if the visitor entered one in order to be notified of the fix.

The entry point is protected by a signed, time-limited token, a bot trap, a minimum delay before sending, a limit of 5 reports per IP address every 10 minutes and an overall cap of 200 reports per day. Captures are bounded in number, in weight and in resolution, and a report about a site other than yours is refused. All of that without imposing a captcha on the visitor.

Yes. The anti-spam token is fetched when the visitor opens the widget, and not when the page loads: a page served from the cache is therefore no problem at all.

The capture is produced from the real content of the page and the styles applied to it: it does not depend on any particular theme or builder. Two honest caveats: it is not a pixel-perfect screenshot, and a font or an image hosted on another domain that forbids cross-origin access may be missing from the image. In every case, the CSS selector and the position of the section make it possible to find the element again. The visitor widget is written in native JavaScript and CSS, with no dependency on a framework.