For your stack
Revenue attribution, checkout funnels and the privacy problem nobody mentions until the security review.
E-commerce analytics has one requirement no other category shares: the numbers have to reconcile with what the payment processor says. A traffic tool that is roughly right is fine for a blog. A revenue figure that is roughly right is an argument with finance.
It also has a privacy problem that most buyers meet late, usually in a security review, and it comes from exactly the tooling that is most useful on a checkout page.
Your analytics and your payment processor will disagree, always, and the gap has predictable causes worth knowing before somebody asks you to explain it.
Consent loss removes orders from analytics that the processor still records. Ad blockers remove more. Refunds and chargebacks land in the processor and usually never reach analytics. Multi-currency rounding differs between systems. Orders completed after a session expires get attributed to direct rather than to the campaign that earned them.
The practical approach is to treat the processor as the source of truth for revenue and analytics as the source of truth for attribution, then never quote an analytics revenue figure in a context where it will be compared to a finance number. Trying to make them reconcile exactly is a project that never finishes.
Every e-commerce site has the same five-step funnel and the same problem: nearly everyone leaves at step three or four. Product viewed, added to basket, checkout started, payment details entered, order completed.
The funnel tells you where. It does not tell you why, and the gap between those two is where most e-commerce analytics projects stall. A twenty per cent drop between checkout started and payment entered is a fact. Whether it is a shipping cost revealed too late, a form field that rejects valid postcodes, or a payment method people expected and did not find, is a question funnels cannot answer.
That is what behaviour tooling is for, which is why heatmaps and session replay are more valuable in e-commerce than in any other category, and also why they are more dangerous here.
Session replay on a checkout page records a form containing a name, an address, an email, a phone number and a card field. Heatmaps are aggregate and largely safe; replay is not.
Every well-known replay tool masks this, and the architectural detail decides how much comfort that should give you. Hotjar, Microsoft Clarity, FullStory, LogRocket and Smartlook all apply masking to content they have received: the field contents are transmitted, then filtered according to your configuration. If a new field ships without the right attribute, or the configuration is wrong, the data has already left the browser and reached a third party.
The stronger design masks every input, textarea and contenteditable element in the browser before transmission and makes you opt fields back in individually, so a misconfiguration fails safe rather than open. On a page carrying payment details that is not a nicety, it is the difference between a control and a promise, and your security review will treat it that way.
If you sell through Amazon, eBay or Google Shopping as well as your own site, your web analytics sees only the part that happens on your domain. Marketplace visibility, competitor pricing and shopping-feed performance are a different class of tool entirely, and no amount of configuration in a web analytics product will surface them.
Budget for that separately rather than being disappointed. What web analytics is for is the part of the journey that happens on your own site, and on most e-commerce operations that is where the recoverable money is anyway.
| Tool | From | Free tier | Cookies | Score |
|---|---|---|---|---|
| Absolutely Analytics | $9 per month | No free tier. A 30-day trial of the exact tier you picked | None, so no consent banner | 8.9 |
| Matomo | Free self-hosted; cloud from €22 | Yes, the entire on-premise product | Optional, and it runs cookieless if configured | 7.0 |
| Plausible Analytics | £9 per month | No, but the community edition is free to self-host | None, so no consent banner | 8.0 |
| Contentsquare | Free then from $39 | Yes, 200,000 monthly sessions on one project | Yes | 5.7 |
| Google Analytics 4 | Free with paid GA360 quoted | Yes, the standard product is free | Yes, so consent is required in the EU and UK | 4.4 |
| PostHog | Free then usage-based | Yes, and it is the most generous on this list | Yes, by default | 7.1 |
Ecommerce revenue attribution, funnels and user journeys on the $19 Business tier, with click and scroll maps from $14 and session replay that masks checkout fields in the browser before transmission.
From $9 per month · None, so no consent banner · Full review →
The most complete e-commerce reporting available without an enterprise contract: product-level reports, abandoned cart analysis, multi-channel attribution and WooCommerce integration, free if you self-host.
From Free self-hosted; cloud from €22 · Optional, and it runs cookieless if configured · Full review →
Ecommerce revenue attribution and funnels on its £19 Business tier, with a clean dashboard anybody in the business can read. No behaviour tooling.
From £9 per month · None, so no consent banner · Full review →
Built for exactly this: zone-based heatmaps with revenue attached to page areas, journey analysis and impact quantification. Enterprise pricing above the free tier.
From Free then from $39 · Yes · Full review →
Enhanced ecommerce reporting is genuinely capable, and if you run Google Shopping or Google Ads the conversion signal is not optional. Consent banner and configuration burden included.
From Free with paid GA360 quoted · Yes, so consent is required in the EU and UK · Full review →
Worth it if your storefront is really an application, with funnels, replay and experiments in one tool and a large free allowance.
From Free then usage-based · Yes, by default · Full review →
Several predictable causes: consent loss and ad blockers remove orders from analytics that the processor still sees, refunds and chargebacks rarely flow back into analytics, multi-currency rounding differs, and orders completed after a session expires get attributed to direct. Treat the processor as the source of truth for revenue and analytics as the source of truth for attribution.
Only with the right masking architecture. Tools that mask content after receiving it have already transmitted the field contents once, so a misconfiguration exposes real customer data. Tools that mask every input in the browser before transmission never send it, so the failure mode is seeing less rather than leaking. On a payment page that distinction is the whole security review.
A cookieless tool with revenue attribution and funnels covers most of it, and bundled heatmaps are worth more in e-commerce than anywhere else because the checkout drop-off question cannot be answered by numbers alone. Matomo is the most capable free option if you can self-host it.
If you run Google Ads or Google Shopping, yes, because the conversion signal feeding smart bidding comes from GA4 exclusively. That is a reason to keep it alongside a lighter tool rather than a reason to make it the dashboard you open every day.
Everything above is my own opinion, formed from published vendor documentation and pricing read on 11 September 2026. There are no affiliate links on this site and no vendor has paid to appear. Corrections welcome.