The heatmap snippet is public, so anyone holding a site's tracking id could post clicks for any page name, filling the heatmap with pages that do not exist and bloating the table. A click is now kept only when its page is a published page of that site. Anything else is ignored with the same empty response, so nothing changes for a visitor.

Sites whose pages are not stored in FerrGrowth (code and external sites) cannot be checked against a page list. For those, the path is still limited to 200 characters, must not contain control characters, and is stored decoded, so a click on /café lands on the café page in the dashboard instead of caf%C3%A9.