Protected actions are identified — and never opened
The most dangerous thing a QA tool can do with an email is click everything in it. SendProofs classifies action-bearing links before any request is made, refuses to open them, and hands them to you for manual review instead.
What is inspected
Every URL extracted from your delivered test email, before checking begins — the URL path, its query parameters and the visible link text. Classification happens at upload time and again on every redirect hop during checking, so a link that looks harmless but redirects into an account action is caught mid-chain.
How the checker handles it
Links recognized as action-bearing by URL and anchor-text patterns are marked Protected and never requested. The patterns cover:
- unsubscribe, opt-out and preference-center links
- sign-in, sign-out and password-reset links, including magic links
- email and account verification or confirmation links, invitation accepts
- order, purchase, approval, cancellation, deletion and access-revoking actions
- likely tracking pixels — image URLs with open/pixel/beacon path segments
If an eligible link redirects toward a recognized action mid-chain, the check stops at that hop: the action destination is not requested, and the resource is reported Protected with the chain recorded up to that point.
What the report shows
| Resource | State | Evidence |
|---|---|---|
| example.com/unsubscribe/%5BREDACTED%5D | Protected | Not opened — review manually |
| app.campaign.example/login?next=%5BREDACTED%5D | Protected | Not opened — review manually |
| img.campaign.example/open/%5BREDACTED%5D.gif | Protected | Not opened — review manually |
Protected items never consume a check when classified at upload; they are listed so your pre-send review can cover them deliberately instead of by accident.
Safety and limits
Detection is pattern-based, on English keywords in paths, query parameters and link text. That catches the common cases decisively, but it is not a guarantee that every conceivable action link is recognized — a bare tokenized path with no recognizable words, or a non-English unsubscribe path, can be classified as an ordinary link and checked. The safe-request rules still apply to it: HEAD-first, no JavaScript, no cookies, no form submission — a request that changes state on GET is a fault of the destination that no crawler, mail scanner or corporate link-checker avoids either. Treat the Protected list as a strong assist for your manual review, not a substitute for it.
Not included
- Opening protected links "safely" — there is no safe automated way to open an unsubscribe or purchase link, so SendProofs does not offer one.
- Showing why each item was protected — the report marks items "Not opened"; per-item reasons are not currently displayed.
- Verifying what is behind a sign-in — destinations that require authentication stay unverified by design.
Related capabilities
Every unique public link in the delivered email, requested once with bounded, safe HTTP checks and the resulting status recorded as evidence.
Redirect evidenceRedirects followed up to three hops with every step recorded — source, target and status — plus warnings for HTTPS downgrades, loops and dead ends.
Evidence reportsTimestamped, human-readable evidence for every checked resource, with a clear next action for each state — not an opaque score or a pass stamp.
See your campaign's protected links before send
Upload the delivered test — the protected list is part of every report.