How to Tell If a Website Uses Heap

Heap (officially Heap Analytics, now part of Contentsquare) is a product-analytics platform best known for autocapture — it records user interactions automatically rather than requiring engineers to tag every event. To detect it, look for the cdn.heapanalytics.com script or the global heap object. This guide covers every reliable signal, the autocapture mechanism that distinguishes Heap, and what its presence tells you.

What is Heap?

Heap is an event-analytics tool in the same family as Mixpanel and Amplitude, but with a different philosophy. Instead of asking developers to instrument each event in code, Heap's library autocaptures clicks, page views, form submissions, taps and other interactions automatically. Analysts then define meaningful events retroactively from that captured data, without shipping new code. That makes it attractive to product teams who want rich behavioural analytics quickly, or who lack the engineering bandwidth for a big manual instrumentation project.

Detecting Heap therefore tells you something specific about the team behind a site: a product-led company that prioritised speed and breadth of data capture, and that values the ability to ask new questions of historical data. Heap was acquired by Contentsquare, so on some properties you may see the two together or a migration in progress.

Heap is especially common among mid-market SaaS products, fintech apps and ecommerce sites that want analytics depth without dedicating engineers to a tagging project for months. It offers a free tier and usage-based pricing, so you will find it on early-stage startups as well as scaled products — which makes it one of the more broadly useful tools to be able to recognise. Because autocapture records everything by default, a Heap install also tends to indicate a team that is comfortable collecting data first and defining the questions later, a philosophy that differs subtly from the hypothesis-driven, manually instrumented approach you see with some Mixpanel and Amplitude deployments.

How Heap loads and sends data

A Heap install starts with a snippet that defines a heap stub, calls heap.load("<app-id>") with the numeric environment ID, and loads the library heap-<app-id>.js from cdn.heapanalytics.com. Once running, Heap's autocapture engine attaches listeners across the page and streams interaction data to heapanalytics.com/h (with related /api endpoints), batching events as the user clicks around. Because it autocaptures, these beacons fire far more frequently than a manually instrumented tool — often on nearly every interaction.

Identity is stored in first-party cookies prefixed _hp2_id.<app-id> (the persistent identity) and _hp2_ses_props.<app-id> (session properties). The _hp2 prefix keyed by a numeric app ID is distinctive and rarely produced by anything else.

How to tell if a website uses Heap

1. View the page source. Search for heap or heapanalytics. The install snippet defines a heap stub, calls heap.load("<app-id>"), and loads cdn.heapanalytics.com/js/heap-<app-id>.js.

2. Check the Network tab. Filter for heap. You will see the library download from cdn.heapanalytics.com and autocaptured events posted to heapanalytics.com/h (and related /api endpoints). Because Heap autocaptures, these beacons fire frequently as you click around the page.

3. Use the console. Type heap and press Enter. The object exposes heap.appid (the numeric environment ID), plus heap.track, heap.identify and heap.addUserProperties. Reading heap.appid gives you the exact project ID.

4. Inspect cookies. Look for first-party cookies prefixed _hp2_id.<app-id> and _hp2_ses_props.<app-id>. The _hp2 prefix keyed by a numeric app ID is distinctive to Heap.

What the Heap signals look like

GET  https://cdn.heapanalytics.com/js/heap-1234567890.js
POST https://heapanalytics.com/h   (autocaptured event payload)
Cookie: _hp2_id.1234567890 = {"userId":"...","pageviewId":"...","sessionId":"..."}

The pairing of the cdn.heapanalytics.com library, the heap global with its appid, and the _hp2_ cookies is conclusive.

Heap versus similar tools — avoiding false positives

Heap can be loaded through a tag manager or a CDP, so the cdn.heapanalytics.com request may appear only after those scripts execute — check the live page. Some teams proxy Heap through a first-party domain to evade ad blockers, hiding the hostname; the heap global and _hp2_ cookies then carry the evidence. Because Heap is now part of Contentsquare, do not be surprised to see Contentsquare's own scripts (*.contentsquare.net) alongside it. And as always, keep the product-analytics trio distinct: Heap (heapanalytics.com, heap global, _hp2_ cookies), Mixpanel (mxpnl.com, mixpanel global) and Amplitude (amplitude.com, amplitude global) all do similar jobs but leave different fingerprints.

Why it is worth knowing a site uses Heap

For sales and competitive research, Heap marks a product-led SaaS or app company that invests in analytics — a strong fit if you sell data, experimentation, or product tooling, and a clue that the buyer values fast iteration. For product teams, spotting Heap on a competitor suggests they rely on autocapture and retroactive analysis rather than a curated event taxonomy, which says something about how they work. For agencies, a Heap install can flag a client who needs help turning raw autocaptured data into trustworthy, governed metrics. And during migration or audit work, identifying Heap is part of mapping the measurement stack — especially because Heap's autocapture data model differs from manually instrumented tools and needs careful handling in any move.

How reliable is each Heap signal?

Rank the evidence as you would for any product-analytics tool. The autocaptured POST to heapanalytics.com/h is definitive and, because Heap autocaptures, it fires often — so it is easy to catch by clicking around with the Network tab open. The _hp2_id.<app-id> and _hp2_ses_props.<app-id> cookies are close behind, as that prefix-plus-numeric-ID pattern is unique to Heap. The heap global is strong, and reading heap.appid confirms the SDK initialised with a real environment. A static cdn.heapanalytics.com script reference is the weakest signal alone. The rule holds: a beacon or _hp2_ cookie is conclusive; a bare script tag is a lead to verify.

What a Heap install reveals about a company

Heap's autocapture model makes its presence a slightly different signal from Mixpanel or Amplitude. Choosing Heap often means the team wanted broad behavioural coverage without a big instrumentation project — a pragmatic choice common at companies that are product-led but engineering-constrained, or that value the ability to define and backfill events retroactively as questions arise. That tells you something about both their priorities and their resourcing.

There is acquisition context worth using, too. Heap is now part of Contentsquare, so a Heap install may sit alongside, or be migrating to, Contentsquare's experience-analytics suite (*.contentsquare.net) — finding both together is a clue about where the account is heading and a potential timing signal for anyone selling analytics services. As with the other tools, also check for a CDP: if window.analytics (Segment) is present and feeding Heap, the data maturity and budget profile of the account rise accordingly. For sellers of product, data and experimentation tools, a Heap install marks a product-led buyer who already believes in behavioural data.

A quick Heap detection checklist

• Click around with the Network tab filtered for heap; a POST to heapanalytics.com/h is conclusive.
• Search the source for cdn.heapanalytics.com and the heap.load("<app-id>") call.
• Type heap in the console and read heap.appid to confirm.
• Check cookies for _hp2_id.<app-id> and _hp2_ses_props.<app-id>.
• Look for Contentsquare (contentsquare.net) or Segment (window.analytics) alongside Heap.
• Treat a lone cdn.heapanalytics.com script tag as a lead, not proof.

Heap in a modern measurement stack

Like the other product-analytics tools, Heap typically sits beside a marketing analytics platform rather than replacing one: a common pairing is Google Analytics 4 for acquisition and Heap for in-product behaviour, so finding Heap should prompt you to check for GA4 too. The combination tells you the team separates the two measurement jobs and wanted broad behavioural coverage without a heavy instrumentation project — which is precisely Heap's pitch.

Heap's autocapture also has a distinctive consequence for what you will observe: because it records interactions automatically, you tend to see frequent beacons to heapanalytics.com/h during a normal session, more than a manually instrumented tool would fire. That makes Heap easy to confirm by simply clicking around with the Network tab open. The flip side is that autocaptured data needs governance to become trustworthy metrics, so a Heap install can hint at a team that values speed of data collection and may need help turning raw events into reliable reporting.

The Contentsquare acquisition adds a layer to read. Some accounts now run Heap and Contentsquare (*.contentsquare.net) together, or are migrating between them, so spotting both is a timing and direction signal. For an auditor, record the app ID, whether GA4 and a CDP (Segment) coexist, whether Contentsquare is present, and how readily autocaptured beacons fire. Those facts let you judge both the company's analytical maturity and where its measurement stack is heading.

Detecting Heap at scale

The console check handles a single page instantly. To scan many domains — for instance, to compile a list of product-analytics adopters for outbound — automate it. StackOptic detects Heap and thousands of other technologies from a real browser, catching tag-manager and CDP-injected installs. See how to find out what analytics a website uses and the Heap profile for more detail.