More than 480 web firms record ‘every keystroke’