Require secure email links

Secure links stop anyone from being recognized as one of your contacts just because they typed or changed a contact ID in a link. Once you turn them on, a link identifies a contact only when it also carries a value from that contact's record, and their browser keeps a signed token instead of the raw ID after the first visit.

Secure links are available for ActiveCampaign and Kit. The Secure links section appears on the integration's Overview tab once the platform is connected. Other platforms don't show it yet.

Why you'd turn them on

Some email platforms number their contacts in order. Anyone who knows your project's ID could try IDs one after another in a link to your site. RightMessage already limits that for every project:

• A browser receives only the contact's email and the fields, tags, and lists your published and draft segments, flows, and other content use. The rest of the contact record stays on the server, unless your project sends the whole profile somewhere, such as a webhook or PostHog.
• An IP address that keeps asking for contacts that don't exist is blocked from contact lookups for the rest of the hour. Visitors arriving from your emails don't come close.

Someone who guesses a real ID can still see that one contact's email and the data your project uses. Secure links close that gap: a bare ID, or one with the wrong value, identifies nobody.

Choose the value to check

1. Open Project settings (the gear at the bottom of the sidebar), then Integrations, and select your connected platform.
2. On Overview, find Secure links.
3. Under Value to check, choose what a link has to carry beside the contact ID.
4. Read the warning, then click Save.

ActiveCampaign offers Signup date and time and each of your custom fields. The strongest choice is a random code that's different for every contact, stored in a custom field you create for it. Signup date and time works well for lists that grew one signup at a time, but contacts you imported or synced in bulk can share a timestamp. Don't pick a value many contacts share, such as country or plan, because anyone who knows the ID could guess it.

Kit offers Kit's hashed email (sh_kit). Kit adds that value to your email links itself, so you don't choose a field.

To turn secure links off, choose Off and click Save.

Update your email links

ActiveCampaign

After you choose a value, Add this to your links shows the exact ending to paste. For signup date and time it's:

?rm_ac=%SUBSCRIBERID%~%SUBDATE%_%SUBTIME%

For a custom field, the part after ~ is that field's personalization tag, such as %SECURE_CODE%. If a link already has a ?, use & in its place. Send yourself a test email and check that the delivered link shows a number, a ~, and the value, with no merge tag left over.

Custom field values match regardless of case, spacing, and punctuation. Signup dates match at the precision the link carries, to the day or the minute.

Kit

In Kit, open Settings, then Advanced, and turn on both Add subscriber_id parameter in email links and Automatically append hashed subscriber email to email links. Kit then adds ck_subscriber_id and sh_kit to every link in your broadcasts and sequences, so you don't edit any links. RightMessage checks that sh_kit matches the subscriber's email and removes both from the address bar.

When it takes effect

ActiveCampaign checks start as soon as you save.

Kit's check needs the latest version of RightMessage on your site, so its option shows a Needs a publish badge. After you save, the section is marked "Goes live once you next publish" and shows a Publish button. Until you publish, visitors are recognized as they are now. After that it's marked "Live now".

What changes for your visitors

• Links in emails you've already sent stop recognizing visitors. They carry only the contact ID. Update your templates and automations before you turn this on, or expect older emails to land as anonymous visits.
• A returning browser stays recognized. After a contact's first secure visit, their browser keeps a signed token and sends it on later pages instead of the ID. Changing Value to check to another field makes everyone check a link again.
• A Kit ck_subscriber_id cookie on its own stops identifying anyone once the check is live.
• Identifying by email keeps working. Email questions, forms, and the email link parameter still recognize visitors. So does the JavaScript identifyByEmail command. identify with a bare contact ID doesn't.
• Guessing locks a contact's links for a day. After five wrong values for one contact within 24 hours, from any address, that contact's links stop working until the day is up. Browsers that already have their token aren't affected.

Check that it's working

1. Send an updated email to a test contact you control.
2. Open its link in a private window and check the contact in the debugger.
3. In another private window, open the same page with only the ID, such as ?rm_ac= and the number. The visitor should stay anonymous.

If your real link leaves the visitor anonymous, check that the value after ~ matches the contact record, that the merge tag rendered, and, for Kit, that you've published and both Kit settings are on. Troubleshoot anonymous visitors covers other causes.