Your newsletter report says 3,000 clicks. Your landing page analytics show 900 visits that stayed longer than a couple of seconds, and the sales number is the same as last month. If that gap looks familiar, a large part of those clicks probably came from software, not from your subscribers.
Corporate mail security systems and some mail clients open the links inside a message to check them before the person reads the email. To your tracking link, that visit looks exactly like a click. This post explains how to recognise these clicks, how they differ from inflated opens, and what to do so your reports show real reader interest.
Email security gateways fetch the links in a message to scan them, often seconds after delivery, often all links in one email, and often from data center addresses. You see it as a click burst right after send, with no activity after it. Find these clicks in the click log, send them to a page you set, keep real readers going to the target, and report the two groups separately.
Why scanners click your links
Phishing is common enough that many companies put a security gateway in front of employee mailboxes. When a message arrives, the gateway looks for dangerous links. To judge a link, the system often opens it, follows the redirects and looks at the page it ends up on. Some mail clients and browsers do something similar to preview a link or warm up a connection.
From the scanner's side this is reasonable. From yours, each scanned link is a request to your tracking domain that your statistics count as a visit. Your newsletter tool may filter some of it and not filter the rest. If you add your own tracker with redirects on top, you get a second place where these hits are counted.
The more B2B your list is, the more this matters. Work addresses are the ones most likely to sit behind a gateway. A list of private mailboxes on consumer providers will show fewer of these clicks, though not none.
How scanner clicks show up in your data
You rarely see one clear marker. You see several small ones together.
- Clicks within seconds of sending. A person needs time to receive, open and read the message. A click one or two seconds after delivery is software.
- All links in the email clicked. Someone who reads a newsletter clicks one or two links. A scanner follows every link, including the unsubscribe link and the footer links, usually in quick order.
- Data center IPs. The requests come from hosting and cloud networks, not from home or mobile providers.
- Odd user agents. Library names, empty strings, or a browser string that is identical across thousands of clicks.
- No follow-up activity. The click does not lead to scrolling, a form start or a conversion. The visit ends where it begins.
- Empty referrer. Email links usually arrive without a referrer anyway, so this is a weak signal alone. It becomes useful in combination with the others.
- Uniform timing across recipients. Hundreds of subscribers from the same company all "click" in the same few seconds.
Opens and clicks inflate for different reasons
People often mix up two separate problems.
Open rates are inflated mainly by privacy features in mail apps, which can load images ahead of time on the reader's behalf, so an open may be recorded when nobody has looked at the message. Open rate has become a weak signal for this reason.
Clicks are inflated mainly by link scanners. A scanner does not need to load images. It follows links, so it adds clicks, and your click-through rate rises along with the click count.
The practical consequence is that you cannot repair one metric by relying on the other. If opens are unreliable and clicks are also polluted, you need a way to separate human clicks from automated ones in your own data. Exact proportions vary by list, by company mix and by tool, so measure them on your own campaigns instead of using someone else's average.
How to check in a click log
You need a click log with a timestamp, IP, provider, user agent and referrer for every click. It can be the log of your tracker or a cloud TDS that your email links pass through. The report inside the newsletter tool is usually too aggregated for this.
- Mark the send time. Take the moment the campaign finished sending, or the batch moment if you send in batches.
- Compute the delay. For each click, subtract the send time. Group clicks into buckets: under 10 seconds, 10 to 60 seconds, 1 to 10 minutes, later.
- Look at the first bucket. A large share of clicks in the first seconds is the strongest hint. Real readers trickle in over hours.
- Group by provider. See how many early clicks come from hosting or cloud providers and how many from consumer providers.
- Check clicks per recipient. If your links carry a subscriber ID, count how many different links each ID clicked within a minute. Several links in one minute is a scanner.
- Check what happens next. Take the early data center clicks and see whether any of them continue to a conversion or any further event. Usually none do.
A hypothetical example. You send to 5,000 addresses and the log shows 3,000 clicks. Of those, 1,500 arrived within 10 seconds of send, 1,400 of the 1,500 came from data center IPs, and none of the 1,500 produced an event after the click. The remaining 1,500 clicks came over the next two days from home and mobile providers, and they produced 45 conversions. Your real click count is closer to 1,500 plus a few early human clicks, so your click-through rate is roughly half of what the first report showed.
| Group | Clicks | Conversions | Typical sign |
|---|---|---|---|
| Within 10 seconds, data center | 1,400 | 0 | Scanner |
| Within 10 seconds, home or mobile | 100 | 1 | Fast human or preview, check manually |
| Later, home or mobile | 1,500 | 44 | Readers |
The numbers are made up for illustration. The pattern is what you should look for in your own log.
What to do about it
Separate scanner traffic from humans at the link
The cleanest approach is to put a routing step between the email link and the destination. Readers go on to the target page. Clicks that look like scanners go to a page you set, such as a neutral page on your domain. Both clicks are still logged, so you can see how many of each group you had.
In TDS.SO you can tick signals for the filter: data centers and an empty referrer are the two that matter most for this case. Filtered clicks go to a page you set and stay in the click log with the reason, for example datacenter. Start with data centers only and watch the log for a couple of campaigns. Add other signals only if the log shows scanners slipping through. You can read how the levels work on the bot protection page.
Mark them separately in reports
Do not delete the scanner clicks from your records. Keep them as their own group. In the TDS.SO overview, clicks are split into humans and bots per day, and the click log can be filtered for bots, so you can report "human clicks" and "automated clicks" next to each other. Details on the analytics page. When you compare campaigns, compare human clicks to human clicks.
Use your own tracking domain
Links that go through a shared tracking domain of your sending tool are hard to inspect on your side. If the email link points to a domain you control, the requests reach your own click log with full detail, and you can apply rules there. In TDS.SO you connect your own domain by pointing its A record to your server and adding it to the list; SSL is issued automatically.
Do not rely on one-click confirmation links
Anything that performs an action on a plain GET request, such as unsubscribe or confirm subscription, will be triggered by a scanner. Make these links lead to a page that asks for a click or a form submission, so a scanner that only fetches the link cannot complete the action on a reader's behalf.
What to watch after you change anything
After you add filtering, compare the next two or three campaigns with earlier ones. Total clicks should fall, human clicks should stay about the same, and conversions should not fall. If conversions fall, open the log, look at the filtered clicks with their reason, and relax the filter. Because the clicks stay in the log, you lose nothing by checking.
There is a related and wider guide on signs of bot traffic that helps if the clicks you are looking at do not come from email.
FAQ
Why does my email have more clicks than readers?
Some clicks come from security software that opens every link in the message to scan it. These clicks are recorded by your tracking link like any other, and one message to a protected mailbox can produce several of them.
How do I tell a scanner click from a real click?
Look at timing, network and next steps. A click seconds after send, from a data center address, on several links of the same email, with nothing afterwards, is almost certainly automated.
Do mail privacy features cause fake clicks?
Privacy features mainly affect opens by loading images in advance. They are a separate issue from link scanners, which affect clicks. Treat both as reasons not to judge a campaign by opens or raw clicks alone.
Should I block scanners completely?
You only need to keep them apart from human clicks so your numbers are right. Sending scanner clicks to a page you set, and keeping them in the log, does that.
Will this affect my sender reputation or deliverability?
The routing described here happens after the click, on your link, so it does not change how the email itself is delivered. After you change rules, send a few test emails to protected mailboxes and check that the links still behave as you expect.
If your email links already pass through a tracker, start with the click log and the bot protection settings in TDS.SO, and compare human clicks per campaign from there.
Guides and write-ups on routing, bot filtering and tracking from the TDS.SO team.
All articles by the author