Why Your Link Shows Clicks Nobody Made
Link previews, email scanners and cloud-server bots open links before people do. What we filter, what still gets through, and how to read your numbers.
· Written by the team that runs Track Link
Short answer
Most clicks nobody made come from machines: chat apps fetching your link to build a preview, email security scanners checking it, and bots running on cloud servers. Track Link leaves out previews and bots that identify themselves and drops redirect clicks from the major cloud-compute networks, but some machine traffic still looks exactly like a person. Your own test taps count too.
Few things are more confusing than a click on a link you haven't shared yet. Or a link you sent to one friend that shows nine clicks. Those clicks are usually real requests. They just weren't made by a person. Something opened the link to look at it.
We run a link tracker, so we spend a lot of time looking at clicks that nobody made. Here is what makes them, what Track Link filters out before it counts anything, what still gets through, and how to read your numbers when they look too high.
Link previews open your link before anyone taps it
When you paste a link into WhatsApp, iMessage, Slack, Telegram, Facebook, LinkedIn, X and most other apps, the app fetches the page to build the little preview card with a title and an image. To a link tracker, that fetch looks like a visit.
The surprising part is who fetches it first. Often it's the sender's own app, right after the link is created or pasted into a message. When we look at these requests, the preview often comes from the same connection that created the link a moment earlier. The recipient's app may then fetch it again when the message arrives.
Most preview fetchers say who they are in their user agent, the short text every browser and bot sends to describe itself. Track Link reads that text before counting a click and leaves out:
- Preview fetchers from social and chat apps, such as Facebook, X, LinkedIn, WhatsApp, Telegram, Slack, Discord and Pinterest
- Search engine crawlers, SEO tools and uptime monitors
- AI crawlers
- Headless and automated browsers, and command-line HTTP tools
- Anything that labels itself a preview, prefetch or prerender, and email image proxies
- Requests with no real user agent at all
The preview still works and the visitor still reaches your page. The request just never becomes a click in your dashboard.
What to do: note the time you share a link. A click at the exact second you pasted it, before anyone could have tapped it, is most likely a preview whose fetcher didn't identify itself.
Bots that look exactly like a phone
A user agent filter only catches bots that are honest about being bots. Plenty aren't. Ad-network scanners, link checkers and click fraud often send a perfectly normal iPhone or desktop browser string. To a filter that only reads the user agent, they look like people.
Nobody browses the web from a rented cloud server, so a click from one is a strong sign of a machine. Since that case, Track Link also drops redirect clicks that come from the IPv4 ranges of the major cloud-compute providers: Amazon EC2, Google Cloud, DigitalOcean, Oracle Cloud, Linode and Vultr.
We drew that line carefully, because a filter that deletes real people is worse than one that misses a few bots:
- CDN ranges aren't blocked. iCloud Private Relay sends real iPhone traffic through content delivery networks, so blocking them would remove real visitors.
- IPv6 isn't filtered. Mobile carriers mostly use IPv6, and a false positive there would quietly delete a real person's click.
- Tracking pixels aren't filtered by IP. Firing a pixel from your own server is a supported integration, so a server address on a pixel is expected.
Across the platform, this filter removed under 2% of clicks, and most of those came from a couple of accounts. For most links it changes nothing. For a link a bot has found, it's the difference between a real number and a made-up one.
It covers the big compute clouds, not every server on the internet. A bot on a smaller host, or on a network we don't filter, can still get through. That's why the reading tips below still matter.
Email security scanners open links too
Send a link to a company email address and the company's security system will often open it before the person does, to check it's safe. Microsoft Defender Safe Links is the best known of these. The checks can arrive seconds after the email lands, and when they come from a network we don't filter, they look like an open.
How to spot them, and how to follow up without being fooled, is in why your link was opened seconds after you sent it.
Your own test clicks count
This one is easy to forget. You create a link and test it. You send it and tap it once more to check it works. Each of those is a real click from a real browser, and Track Link counts it like anyone else's.
On the location-request links we looked at, the sender opened their own link on about half of them. That's a lot of "someone opened it" moments that were really the owner.
- Expect your own test to show up, and note the time you made it.
- Test once, not five times. Later taps from the same phone on the same network show as repeat clicks, but they still add to the total.
- If you want to see the link exactly as a stranger would, test it once in a private window.
How Track Link decides a click is unique
Every link page shows total clicks and unique visitors. It helps to know how the second number works before you trust either one.
When a click comes in, Track Link combines the visitor's network address and their browser's user agent into a fingerprint. The first click with that fingerprint on a link is unique. Any later click on the same link with the same fingerprint is a repeat. There's no session timer: what matters is whether that address and browser have opened this link before.
- One person tapping twice on the same phone and network is one unique visitor and two clicks.
- One person on their phone and then their laptop is two unique visitors.
- A phone that switches from Wi-Fi to mobile data gets a new address, so it can count as unique again.
- Two people on the same office Wi-Fi with the same phone and browser version can merge into one.
We also mark traffic that behaves like a scanner as not unique, even when it gets past the other filters. We use the network address to tell visits apart, but your dashboard doesn't show visitor IP addresses.
What to do: when total clicks are far above unique visitors, someone or something is opening the link over and over. When the two are close, you're looking at many different visitors.
Signs a click wasn't a person
Open the link's click log, which lists every click with its time, source, country, location, device and browser. These are the patterns we look for first:
| What you see | What it usually means |
|---|---|
| A click seconds after you posted or sent the link | A preview fetch or a security scanner. People rarely react that fast. |
| Clicks at odd hours from places known for data centres | A server checking or scraping the link, not someone in that city at 3am. |
| A burst of clicks with identical device, browser and location | One machine or one script repeating itself. |
| Far more clicks than people who could have seen it | If you sent a link to three people and it shows forty clicks, most of them aren't those three people. |
| Many clicks, few unique visitors | Something opening the link again and again from the same place. |
What to do when the numbers look wrong
- Note when you shared it. Clicks before that moment, or within seconds of it, are almost always previews, scanners or you.
- Read the click log, not just the total. Look at time, location and device together. A run of identical rows tells you more than any single number.
- Use one link per channel. Separate links for your newsletter, your bio and your sales emails keep bot traffic on one from muddying the others. UTM tags help here too.
- Lean on unique visitors. For a link sent to a handful of people, unique visitors is the closer number to reality.
- Check where the link goes. If clicks look fine but your site shows nothing, run the short link through the link tracer to see every hop on the way to your page.
- Tell us. The cloud-server filter exists because an owner noticed their numbers were wrong and said so. If yours look off, get in touch.
If your clicks look right but don't match your analytics, that's a different question, covered in why link clicks never match Google Analytics. And for how we keep the links themselves from being abused, see how we stop phishing links.
Questions people ask
Why does my link show clicks before I shared it?
Usually an app fetched it to build a preview, often your own app right after you pasted it, or you opened it yourself to test. Track Link leaves out previews that identify themselves, but your own test taps count like anyone else's.
Does Track Link count link previews from WhatsApp, Slack or Facebook as clicks?
No. Preview fetchers that identify themselves in their user agent, including WhatsApp, Telegram, Slack, Discord, Facebook, X and LinkedIn, are left out before a click is recorded. The preview itself still loads normally.
Do filtered bot clicks count toward my plan's click limit?
No. Clicks we filter out as previews, bots or cloud-server traffic are never recorded, so they don't count toward your monthly clicks.
Why are my unique visitors lower than my total clicks?
A click is unique the first time a given network address and browser open that link. Repeat taps from the same phone on the same network add to total clicks but not to unique visitors.
Can bots still get past Track Link's filters?
Some can. A bot on a network we don't filter that sends a normal browser user agent looks like a person. Email security scanners running on Microsoft's network are the most common example.
See it on your own links
Track Link is free to start: sign in with Google or Microsoft, no credit card.