Guide
Security scanners and similar tools follow every link in a message, so a link that unsubscribes or confirms on a plain visit acts without the recipient. An unsubscribe or confirmation page must require the recipient to do something, such as tick a checkbox or press a button. A click on the link must never be what triggers the change. This is one symptom of Non-Human Interactions (NHI), the industry term for bot clicks and bot opens.
By Omnivery. Published October 2026. Last reviewed October 2026
People are unsubscribed who never clicked anything. Bookings, pauses or confirmations are recorded with no human action. A large share of a list opts out within minutes of delivery, long before most recipients could have opened the message. The unsubscribe count and the click report both look like engagement, and neither one is.
Security software follows the links in a message to check them for malware and phishing, usually before the recipient sees the message. Read-aloud and preview tools fetch links too. None of them can tell which link is the unsubscribe link, and a plain link carries no signal that visiting it should be treated differently from reading it. If your system changes state when the URL is requested, the scanner has just made that choice for the recipient.
Vendors try to avoid unsubscribe and confirmation links, and some of them still get clicked. A sender cannot rely on that. Our page about bot clicks and bot opens explains where scanner traffic comes from.
The fix
A visit to a link must never change anything. The recipient has to take a deliberate action on the page, and only that action makes the change.
The unsubscribe or confirm link loads a page that says what is about to happen and for which address. Nothing has changed yet, however the page was reached.
Add a button such as "Unsubscribe" or "Confirm my subscription", or a checkbox followed by a submit button. Only that action completes the change. Without an interactive element the page is just another link.
The button submits a form with POST. Software that follows links requests pages with GET, which is meant for reading, so a visit alone cannot unsubscribe or confirm anyone.
A double opt-in link that confirms on page load can create a consent record the recipient never gave. Show a confirmation page and require a deliberate submit, as described in the double opt-in guide.
One-click unsubscribe under RFC 8058 already uses POST by design, through the List-Unsubscribe and List-Unsubscribe-Post headers. The link in the message body needs the same protection. See the List-Unsubscribe header guide.
One clear control, the address shown on screen, and a plain confirmation afterward. The extra step should cost the recipient a second, not a hunt for the right button.
No. Every sender needs a working unsubscribe link in the message body, and recipients and mailbox providers expect to see it. Hiding or obscuring it breaks the one thing the link is for and risks complaints, which hurt your sender reputation more than a scanner click does.
Not safely. An unsubscribe that a real person requested must always be honored. Do not guess which requests are real. Make a link visit incapable of unsubscribing anyone, so every unsubscribe you record is one a person chose.
No. Saving one click is not worth recording choices people did not make. Unsubscribing someone who never asked loses a subscriber, and confirming someone who never asked creates a consent record that is not real.
At a glance
Questions
Usually because software followed the unsubscribe link for them. Security scanners and similar tools visit every link in a message, and a system that unsubscribes on a plain link visit records that as the recipient's choice.
Scanners follow confirmation links like any other link. If the link confirms on page load, the scanner confirms for the recipient. The link must open a page with a button or checkbox the recipient uses to confirm.
POST is the request method a browser uses when a form is submitted. Link-following tools request pages with GET, which is meant for reading. Changing anything only on POST means a visit alone cannot change state.
Yes. One-click unsubscribe under RFC 8058 is defined as a POST request, so scanners following GET links do not trigger it. The unsubscribe link in the message body needs the same protection.
Not automatically. Fix the page so a link visit cannot unsubscribe anyone, and honor any request a real person made.
Yes. The page must have an interactive element the recipient uses to complete the unsubscribe. If reaching the page is enough to unsubscribe someone, a scanner that follows the link will unsubscribe them.
Read the overview of bot clicks and bot opens, or see how the double opt-in guide handles confirmation links.