--- title: 'Why Bots Click Unsubscribe and Confirm Links' url: 'https://omnivery.com/resources/non-human-interactions/bots-clicking-unsubscribe-links' markdown: 'https://omnivery.com/resources/non-human-interactions/bots-clicking-unsubscribe-links.md' lang: en date: '2026-10-22' description: 'Security scanners follow every link, including unsubscribe and confirm links. Why people get unsubscribed without clicking, and and why the page needs a button or checkbox.' --- Guide # Why bots click unsubscribe and confirm links (and how to stop it) Security scanners and similar tools follow every link in a message, so a link that unsubscribes or confirms on a plain visit acts without the recipient. An unsubscribe or confirmation page must require the recipient to do something, such as tick a checkbox or press a button. A click on the link must never be what triggers the change. This is one symptom of Non-Human Interactions (NHI), the industry term for bot clicks and bot opens. By Omnivery. Published October 2026. Last reviewed October 2026 ## What does it look like when bots click unsubscribe links? People are unsubscribed who never clicked anything. Bookings, pauses or confirmations are recorded with no human action. A large share of a list opts out within minutes of delivery, long before most recipients could have opened the message. The unsubscribe count and the click report both look like engagement, and neither one is. ## Why do scanners click unsubscribe and confirm links? Security software follows the links in a message to check them for malware and phishing, usually before the recipient sees the message. Read-aloud and preview tools fetch links too. None of them can tell which link is the unsubscribe link, and a plain link carries no signal that visiting it should be treated differently from reading it. If your system changes state when the URL is requested, the scanner has just made that choice for the recipient. Vendors try to avoid unsubscribe and confirmation links, and some of them still get clicked. A sender cannot rely on that. Our [page about bot clicks and bot opens](https://omnivery.com/resources/non-human-interactions) explains where scanner traffic comes from. The fix ## How should unsubscribe and confirmation pages work? A visit to a link must never change anything. The recipient has to take a deliberate action on the page, and only that action makes the change. 1. #### The link opens a page, it does not act The unsubscribe or confirm link loads a page that says what is about to happen and for which address. Nothing has changed yet, however the page was reached. 2. #### The recipient must interact with the page Add a button such as "Unsubscribe" or "Confirm my subscription", or a checkbox followed by a submit button. Only that action completes the change. Without an interactive element the page is just another link. 3. #### Submit with POST, never change state on GET The button submits a form with POST. Software that follows links requests pages with GET, which is meant for reading, so a visit alone cannot unsubscribe or confirm anyone. 4. #### Confirmation links follow the same rule A double opt-in link that confirms on page load can create a consent record the recipient never gave. Show a confirmation page and require a deliberate submit, as described in the [double opt-in guide](https://omnivery.com/resources/guides/double-opt-in). 5. #### Keep the one-click header as it is One-click unsubscribe under RFC 8058 already uses POST by design, through the List-Unsubscribe and List-Unsubscribe-Post headers. The link in the message body needs the same protection. See the [List-Unsubscribe header guide](https://omnivery.com/resources/guides/list-unsubscribe-header). 6. #### Make the page easy to finish One clear control, the address shown on screen, and a plain confirmation afterward. The extra step should cost the recipient a second, not a hunt for the right button. ## Should you remove the unsubscribe link or hide it from scanners? No. Every sender needs a working unsubscribe link in the message body, and recipients and mailbox providers expect to see it. Hiding or obscuring it breaks the one thing the link is for and risks complaints, which hurt your sender reputation more than a scanner click does. ## Can you simply ignore unsubscribes that look automated? Not safely. An unsubscribe that a real person requested must always be honored. Do not guess which requests are real. Make a link visit incapable of unsubscribing anyone, so every unsubscribe you record is one a person chose. ## Is it acceptable to unsubscribe on the first click to save the recipient a step? No. Saving one click is not worth recording choices people did not make. Unsubscribing someone who never asked loses a subscriber, and confirming someone who never asked creates a consent record that is not real. At a glance ## Bots clicking unsubscribe links at a glance - Security scanners and similar tools follow every link in an email, including unsubscribe and confirmation links. - A system that changes state when a link is requested records a scanner visit as the recipient's decision. - Non-Human Interactions (NHI) is the industry term for opens and clicks made by software instead of the person you sent to. - An unsubscribe or confirmation page must have an interactive element, such as a checkbox or a button, that the recipient uses to complete the action. - Clicking the link in the email must never be what triggers an unsubscribe or a confirmation. - The page submits the change with POST, and state must never change on a plain GET request. - One-click unsubscribe under RFC 8058 uses POST by design, so scanners following GET links do not trigger it. - An opt-in confirmation link that confirms on page load can record consent the recipient never gave. - An unsubscribe request from a real person must always be honored, so the unsubscribe link must stay visible in the message. Questions ## Bots and unsubscribe links: questions ### Why are people unsubscribing without clicking? Usually because software followed the unsubscribe link for them. Security scanners and similar tools visit every link in a message, and a system that unsubscribes on a plain link visit records that as the recipient's choice. ### Why are my confirmation links being clicked by bots? Scanners follow confirmation links like any other link. If the link confirms on page load, the scanner confirms for the recipient. The link must open a page with a button or checkbox the recipient uses to confirm. ### What is POST and why does it stop bots? POST is the request method a browser uses when a form is submitted. Link-following tools request pages with GET, which is meant for reading. Changing anything only on POST means a visit alone cannot change state. ### Does one-click unsubscribe protect against scanners? Yes. One-click unsubscribe under RFC 8058 is defined as a POST request, so scanners following GET links do not trigger it. The unsubscribe link in the message body needs the same protection. ### Should I suppress addresses that unsubscribe right after delivery? Not automatically. Fix the page so a link visit cannot unsubscribe anyone, and honor any request a real person made. ### Does an unsubscribe page need a button or checkbox? Yes. The page must have an interactive element the recipient uses to complete the unsubscribe. If reaching the page is enough to unsubscribe someone, a scanner that follows the link will unsubscribe them. ## Sources - [RFC 8058: Signaling One-Click Functionality for List Email Headers](https://www.rfc-editor.org/rfc/rfc8058). Defines one-click unsubscribe as a POST request. - [Bot clicks and bot opens in email (NHI)](https://omnivery.com/resources/non-human-interactions). Omnivery's overview of where non-human clicks come from. ## Related reading - [Bot clicks and bot opens in email (NHI)](https://omnivery.com/resources/non-human-interactions) - our overview of what causes non-human interactions and what to do about them. - [The List-Unsubscribe header](https://omnivery.com/resources/guides/list-unsubscribe-header) - how RFC 8058 one-click unsubscribe works and why it uses POST. - [Double opt-in](https://omnivery.com/resources/guides/double-opt-in) - why confirmation links need the same protection as unsubscribe links. ## Make every unsubscribe a real choice Compliance Read the overview of bot clicks and bot opens, or see how the double opt-in guide handles confirmation links. [Double opt-in guide](https://omnivery.com/resources/guides/double-opt-in)[Bot clicks and bot opens explained](https://omnivery.com/resources/non-human-interactions) --- ## Navigation - Parent: [Non-Human Interactions](https://omnivery.com/resources/non-human-interactions.md) - Previous: [How ESPs Report Bot Opens and Clicks](https://omnivery.com/resources/non-human-interactions/how-esps-report-non-human-activity.md)