Filter sensitive URL content

Configure ugcFilterRules to replace sensitive user-generated content in URLs before the SDK records URLs in replays and heatmaps. Use web masking settings to protect page text and form inputs.

1. Identify URLs that contain sensitive user IDs, company names, query parameters, or dynamic path segments.
2. Choose selectors and descriptive replacement URLs using the UGC Filter Rules reference.
3. Put specific rules before general rules. The SDK uses the first matching rule.
4. Add the rules to interactionConfig during SDK initialization and set enabled: true.

Configure UGC Filter Rules

Configure UGC Filter Rules as part of the interactionConfig when initializing the Session Replay SDK:

import { sessionReplay } from "@amplitude/session-replay-browser";

sessionReplay.init("YOUR_API_KEY", {
  // ...
  // Other Configs
  // ...
  interactionConfig: {
    enabled: true,
    ugcFilterRules: [
      {
        selector: "https://example.com/user/*/profile",
        replacement: "https://example.com/user/USER_ID/profile",
      },
      {
        selector: "https://example.com/api/token=*",
        replacement: "https://example.com/api/token=REDACTED",
      },
    ],
  },
});

Test patterns in a development environment first

Validate that your glob patterns match expected URLs in a development environment. The following array lists example URLs to include in your checks; it doesn't execute a test:

// Test with various URL formats
const testUrls = [
  "https://mycompany.projecttool.com/browse/PROJ-123",
  "https://codehost.com/username/repository/tree/main/src/components",
  "https://myapp.com/user/john.doe@email.com/profile",
];