What they are genuinely good at is explaining behaviour that analytics can only report. Analytics tells you that eighty percent of people leave your pricing page without contacting you. A heat map can show that almost nobody scrolls far enough to reach the contact button, or that people are repeatedly clicking something that is not a link because it looks like one. That is a diagnosis rather than a measurement, and it usually produces a fix you can implement the same day.
The limitation is traffic volume, and it is the reason this is rarely useful in a first year. These tools need a meaningful number of sessions before the picture means anything. A page receiving twenty visits a month produces a heat map that mostly reflects who happened to visit, and reading intent into that is worse than not looking. Several hundred sessions on a single page is a reasonable floor.
Use them tactically rather than continuously. Turn recording on for one page you have a specific question about, gather enough sessions to see a pattern, make the change, and turn it off. Leaving these tools running permanently costs money, adds a script to every page load, and collects visitor behaviour you then have a privacy obligation to disclose and manage.
Before reaching for one, there is a free version that works at any traffic level. Sit somebody who has never seen your site in front of it, give them a task, and watch without helping. Five people will reveal more than a heat map of five hundred sessions, because you can ask them why.
Ask a specific question before turning one on, because these tools produce an enormous amount of ambiguous information and no answer unless you arrived with one. Whether people reach the contact button, whether anybody uses the navigation, whether the second section is ever seen. A recording watched without a question in mind produces the impression that visitors behave strangely, which is true of everybody and actionable about nobody.
Understand the privacy position before installing one, because these tools record visitor behaviour and in some cases the contents of forms. Reputable products mask input fields by default and that default can be changed, which means a misconfiguration can capture things you have no business holding. If you use one, check what is being recorded, disclose it in your privacy policy, and turn it off when the question is answered rather than leaving it running indefinitely.