# HawkOpen — Questions and answers (English)
> Short, checked answers about email tracking, read receipts, campaigns, documents and signatures, plans, privacy and the law. Each answer says what the product does today.
> This information is general and concerns the features of HawkOpen (TriStiX S.L.). It is not individual legal advice or an assessment of whether a specific campaign or document complies with the law. Customers make their own decisions about their activities and, where needed, consult a qualified specialist. This does not limit any rights they have under mandatory law.
URL: https://hawkopen.com/en/faq
JSON: https://hawkopen.com/en/faq.json
Checked: 2026-11-13
## Link clicks, bots and scanners
How link tracking works and how HawkOpen tells a person’s click from a security scanner.
URL: https://hawkopen.com/en/faq/clicks
### How do I track link clicks in my emails?
URL: https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks
Link tracking works only after your company’s owner or an administrator switches it on, and only for recipients whose consent to link tracking is recorded for your company; everyone else gets an ordinary email with unchanged links. In a tracked copy every https link becomes a short HawkOpen address that records the click and takes the reader to the original page. The free plan tracks links in 10 emails a month; Pro and Business have no such limit.
Opens and links are separate purposes: the company switches each on separately, and each needs its own consent from the recipient, so a person can be tracked for links but not for opens. A consent comes from the recipient’s own act, for example the HawkOpen consent form behind a link your company passes on itself, or is recorded by the owner or an administrator from consents your company collected. Links that do not start with https, such as links to an email address or plain http links, stay as they are and are not tracked.
Each click gets a category, such as **security scanner**, **link preview** or **human**, with the rule codes behind it. A single click does not send a notification; on Business an email click alert can tell you about the first click that is not classified as a machine. A click is often a stronger signal than an open, but company filters also click links, so read the category before drawing conclusions.
Related questions: [Are bot clicks inflating my click rate, and how do I filter scanner clicks?](https://hawkopen.com/en/faq/clicks/bot-clicks-inflate-click-rate), [What is link tracking, and how is a tracking link made or removed?](https://hawkopen.com/en/faq/clicks/link-tracking-what-is-and-how), [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending)
Checked: 2026-11-12
### Are bot clicks inflating my click rate, and how do I filter scanner clicks?
URL: https://hawkopen.com/en/faq/clicks/bot-clicks-inflate-click-rate
Often, yes: company security filters open links to check them, and a simple counter shows that as a click. HawkOpen rates each click with named rules and separates scanner clicks from likely human ones, without any setup; scanner clicks never trigger a notification.
Signs of a scanner include three or more links clicked within two seconds (R-CLK-BURST), a click from a security vendor’s network (R-CLK-VENDOR), from a cloud or hosting network (R-CLK-CLOUD, R-CLK-HOSTING), from a browser without a window (R-CLK-HEADLESS) or an automated one (R-CLK-WEBDRIVER), and a click within seconds of delivery (R-CLK-DELTA). A click from a data-centre network is never classified as likely human activity.
Signs of human activity include the page running in a visible browser tab (R-CLK-JS), a home or mobile network (R-CLK-RESID) and a click well after delivery (R-CLK-LATE). Even then the verdict is at most “likely”. The rules are versioned, so stored clicks can be classified again when they improve.
Related questions: [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending), [How do I track link clicks in my emails?](https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks), [Are open rates still reliable after Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/open-rate-after-apple-mpp)
Checked: 2026-11-11
### What is link tracking, and how is a tracking link made or removed?
URL: https://hawkopen.com/en/faq/clicks/link-tracking-what-is-and-how
A tracking link sends the reader through a short address that records the click and then opens the real page. In HawkOpen you do not make them by hand: in a copy tracked for links, every https link is converted automatically; in any other copy, links stay unchanged.
Marketing parameters such as utm_ tags are something else: they tell a website where a visitor came from, but do not record the click by themselves. A HawkOpen tracking link records the click on HawkOpen’s side, rates it, and then forwards the reader.
As a sender: link tracking is off until your company’s owner or an administrator switches it on, and even then only recipients who consented to link tracking get tracked links. Before sending you can also switch link tracking off for a message or a campaign; links that do not start with https are never converted. As a recipient of an email tracked by HawkOpen, you can use the link “Do not track my activity” at the end of the message: opening it refuses tracking by that company at once and deletes what was measured about you before; the company cannot switch it back, only you can, on the same page.
Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.
Related questions: [How do I track link clicks in my emails?](https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks), [How do I block email tracking?](https://hawkopen.com/en/faq/detect-block/how-to-block-email-tracking)
Checked: 2026-11-12
### Does HawkOpen recognise link previews and AI assistants?
URL: https://hawkopen.com/en/faq/clicks#ai-agents-and-link-previews
Yes, when they identify themselves. A request from a link-preview bot (as in chat apps) or a declared AI agent gets the category **link preview**, with rules such as R-CLK-PREVIEW and R-CLK-AI-DECLARED, and is never classified as human activity.
The same applies to the tracking image (R-OPEN-PREVIEW, R-OPEN-AI-DECLARED). A preview often means someone shared your link, but the event itself is a machine. An assistant that does not identify itself is judged by the other rules, such as speed, network and browser behaviour.
Related questions: [How does HawkOpen detect headless browsers and bots?](https://hawkopen.com/en/faq/clicks#headless-browser-detection), [Are bot clicks inflating my click rate, and how do I filter scanner clicks?](https://hawkopen.com/en/faq/clicks/bot-clicks-inflate-click-rate)
Checked: 2026-11-11
### Can I track clicks on links inside a PDF?
URL: https://hawkopen.com/en/faq/clicks#click-tracking-for-links-inside-pdf
No. HawkOpen tracks links in the body of the email, not inside a PDF. For a PDF shared as a HawkOpen link it records sessions and time per page once the recipient agrees to it on the PDF page; file sharing waits for the malware-scanning service, which is not switched on yet.
If a link in a document matters, put the same link in the email as well: that one is tracked like any other https link.
Related questions: [How do I track link clicks in my emails?](https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks), [Can tracking show how long someone read the email?](https://hawkopen.com/en/faq/accuracy#how-long-was-email-read)
Checked: 2026-11-11
### Which security scanners cause false clicks, and does HawkOpen recognise Proofpoint, Mimecast, Barracuda or Safe Links?
URL: https://hawkopen.com/en/faq/clicks#security-scanners-recognised
Gateways like these check links in incoming mail and can click every one of them. HawkOpen recognises them by where the request comes from (known security-vendor and data-centre networks) and by how it behaves, and marks such clicks as **security scanner**.
Behaviour counts as much as the network: a click within seconds of delivery, three or more links within two seconds, a browser with no window or no real browser behind the request. HawkOpen does not promise to name every product; the rule codes show why a click was judged a scanner.
Scanner clicks stay in the event list, but they trigger no notification and are left out of the click rate in reports.
Related questions: [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending), [Are bot clicks inflating my click rate, and how do I filter scanner clicks?](https://hawkopen.com/en/faq/clicks/bot-clicks-inflate-click-rate), [Why do the links in my sent emails look different or get rewritten?](https://hawkopen.com/en/faq/clicks#why-do-links-in-my-email-change-safelinks)
Checked: 2026-11-11
### How does HawkOpen detect headless browsers and bots?
URL: https://hawkopen.com/en/faq/clicks#headless-browser-detection
With named rules: a browser that reports itself as headless (R-CLK-HEADLESS), one controlled by automation (R-CLK-WEBDRIVER), a request without a language header (R-CLK-NOLANG), and a program that claims to be a modern browser but does not behave like one (R-CLK-NOFETCH).
Each rule adds points towards a machine; enough points make the click a **security scanner**. Signs of human activity, such as a real browser with a visible page (R-CLK-JS), pull the other way. The verdict lists every rule that matched.
Related questions: [Which security scanners cause false clicks, and does HawkOpen recognise Proofpoint, Mimecast, Barracuda or Safe Links?](https://hawkopen.com/en/faq/clicks#security-scanners-recognised), [What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?](https://hawkopen.com/en/faq/accuracy#rule-codes-explained)
Checked: 2026-11-11
### Does HawkOpen use hidden “honey” links to expose scanners?
URL: https://hawkopen.com/en/faq/clicks#honey-links
Not today. The rules have codes for such links (R-CLK-HONEY), but HawkOpen does not add hidden links to the emails it sends. It recognises scanners by their network and behaviour instead.
A hidden link is something a person cannot see, so a click on it points to a machine. Adding invisible links also changes your message, which is why HawkOpen relies on the other rules.
Related questions: [Which security scanners cause false clicks, and does HawkOpen recognise Proofpoint, Mimecast, Barracuda or Safe Links?](https://hawkopen.com/en/faq/clicks#security-scanners-recognised), [How does HawkOpen detect headless browsers and bots?](https://hawkopen.com/en/faq/clicks#headless-browser-detection)
Checked: 2026-11-11
### Why do the links in my sent emails look different or get rewritten?
URL: https://hawkopen.com/en/faq/clicks#why-do-links-in-my-email-change-safelinks
Two things can change them. In a copy tracked for links (your company switched link tracking on and the recipient’s consent is recorded), HawkOpen turns each https link into a short HawkOpen address that records the click and forwards to the page. On the recipient’s side, a security gateway such as Microsoft Safe Links may wrap that link again to check it before the click.
HawkOpen cannot stop a gateway from rewriting links. When the gateway follows the link to check it, HawkOpen records a click and marks it as a **security scanner**, not as human activity. To send links unchanged by HawkOpen, switch link tracking off for the message or campaign.
Related questions: [Which security scanners cause false clicks, and does HawkOpen recognise Proofpoint, Mimecast, Barracuda or Safe Links?](https://hawkopen.com/en/faq/clicks#security-scanners-recognised), [What is the HawkOpen address in my links, and what does the recipient see?](https://hawkopen.com/en/faq/clicks#tracking-link-domain-meaning), [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending)
Checked: 2026-11-12
### Can I track clicks on links in my signature?
URL: https://hawkopen.com/en/faq/clicks#tracked-links-in-email-signature
Yes, if the signature is part of the message HawkOpen sends and that copy is tracked for links: every https link in it is tracked, wherever it is. HawkOpen does not treat signature links separately, and a signature added by another program after sending is not seen.
On the free plan, link tracking covers 10 emails a month, signature links included; opens are tracked beyond that.
Related questions: [How do I track link clicks in my emails?](https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks), [What is link tracking, and how is a tracking link made or removed?](https://hawkopen.com/en/faq/clicks/link-tracking-what-is-and-how)
Checked: 2026-11-12
### Why do I see opens but no clicks?
URL: https://hawkopen.com/en/faq/clicks#troubleshoot-open-without-click
Most readers do not click, and some opens are not human activity at all: Apple Mail Privacy Protection, Gmail’s proxy and scanners load the image without anyone reading. Check the category of each open before you conclude the message was read.
Also check that link tracking applied to that copy: your company must have it switched on, the recipient needs a recorded consent to link tracking, which is separate from the consent to opens, and the links must start with https; other links are not tracked. On the free plan, links are tracked in 10 emails a month.
Related questions: [What is the difference between an open and a click?](https://hawkopen.com/en/faq/accuracy#difference-between-open-and-click), [What happens if the recipient blocks images?](https://hawkopen.com/en/faq/accuracy/what-if-recipient-blocks-images)
Checked: 2026-11-12
### Can a security scanner use up my link before the recipient clicks it?
URL: https://hawkopen.com/en/faq/clicks#link-opened-by-scanner-consumes-one-time-link
Not a HawkOpen tracked link: it is not single-use and forwards to the page on every request, scanners included. The scanner’s visit is recorded as a security-scanner click and the recipient’s later click works normally.
A destination page with its own one-time token is another matter: HawkOpen forwards the scanner there too, so a page that expires after one visit can still be used up. Prefer pages that ask the person to confirm, for example with a code.
Related questions: [Which security scanners cause false clicks, and does HawkOpen recognise Proofpoint, Mimecast, Barracuda or Safe Links?](https://hawkopen.com/en/faq/clicks#security-scanners-recognised), [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending)
Checked: 2026-11-11
### Do long tracking links break when a gateway wraps them?
URL: https://hawkopen.com/en/faq/clicks#long-tracking-urls-broken-by-link-wrapping
It can happen with very long addresses. A HawkOpen tracked link carries an encoded copy of the destination, so it is about a third longer than the original; destinations longer than 4096 bytes are left untracked. HawkOpen has not tested every gateway’s length limit.
Shorter destination addresses, without long tracking parameters, leave more room. If a recipient reports a broken link, send the plain address or switch link tracking off for that message.
Related questions: [Why do the links in my sent emails look different or get rewritten?](https://hawkopen.com/en/faq/clicks#why-do-links-in-my-email-change-safelinks), [Why does a tracked link show an error instead of the page?](https://hawkopen.com/en/faq/clicks#invalid-url-error-on-tracked-link)
Checked: 2026-11-12
### What is the HawkOpen address in my links, and what does the recipient see?
URL: https://hawkopen.com/en/faq/clicks#tracking-link-domain-meaning
It is the short redirect that records the click. When the recipient hovers over the link, they see a HawkOpen address; when they click, HawkOpen notes the click and immediately forwards them to your original https page.
Some mail programs warn about links whose visible text differs from the address. Write the link as text (for example “price list”) rather than pasting a different web address as the visible text. A tracked email also ends with the notice “This message contains HawkOpen tracking elements.” and the link “Do not track my activity”.
There is no setting to put your own domain in the links. If you prefer plain links, switch link tracking off for the message or campaign; opens can still be tracked for recipients who consented to them.
Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.
Related questions: [What is link tracking, and how is a tracking link made or removed?](https://hawkopen.com/en/faq/clicks/link-tracking-what-is-and-how), [Why do the links in my sent emails look different or get rewritten?](https://hawkopen.com/en/faq/clicks#why-do-links-in-my-email-change-safelinks)
Checked: 2026-11-12
### Why does a tracked link show an error instead of the page?
URL: https://hawkopen.com/en/faq/clicks#invalid-url-error-on-tracked-link
Usually because the link address was damaged on the way, for example cut off, wrapped across lines or edited. HawkOpen then does not recognise the code in the link and answers “not found”, because it no longer knows where to send the reader.
Ask the recipient to click the link in the original email rather than a copied address, or send them the plain address. Long destinations are more exposed to this; very long ones are not tracked at all.
Related questions: [Do long tracking links break when a gateway wraps them?](https://hawkopen.com/en/faq/clicks#long-tracking-urls-broken-by-link-wrapping), [What is the HawkOpen address in my links, and what does the recipient see?](https://hawkopen.com/en/faq/clicks#tracking-link-domain-meaning)
Checked: 2026-11-11