--- title: "Require secure email links" description: "You'll make email links recognize a contact only when they carry a second value that matches that contact, so a guessed or edited ID identifies nobody." canonical: "https://rightmessage.com/help/secure-email-links" last-updated: 2026-10-30 --- # Require secure email links You'll make email links recognize a contact only when they carry a second value that matches that contact, so a guessed or edited ID identifies nobody. Available on the Grow, Scale, and Pro plans. Secure links stop anyone from being recognized as one of your contacts just because they typed or changed a contact ID in a link. Once you turn them on, a link identifies a contact only when it also carries a value from that contact's record, and their browser keeps a signed token instead of the raw ID after the first visit. Secure links are available for ActiveCampaign and Kit. The **Secure links** section appears on the integration's **Overview** tab once the platform is connected. Other platforms don't show it yet. ## Why you'd turn them on Some email platforms number their contacts in order. Anyone who knows your project's ID could try IDs one after another in a link to your site. RightMessage already limits that for every project: - A browser receives only the contact's email and the fields, tags, and lists your published and draft segments, flows, and other content use. The rest of the contact record stays on the server, unless your project sends the whole profile somewhere, such as a webhook or PostHog. - An IP address that keeps asking for contacts that don't exist is blocked from contact lookups for the rest of the hour. Visitors arriving from your emails don't come close. Someone who guesses a real ID can still see that one contact's email and the data your project uses. Secure links close that gap: a bare ID, or one with the wrong value, identifies nobody. ## Choose the value to check 1. Open **Project settings** (the gear at the bottom of the sidebar), then **Integrations**, and select your connected platform. 2. On **Overview**, find **Secure links**. 3. Under **Value to check**, choose what a link has to carry beside the contact ID. 4. Read the warning, then click **Save**. **ActiveCampaign** offers **Signup date and time** and each of your custom fields. The strongest choice is a random code that's different for every contact, stored in a custom field you create for it. Signup date and time works well for lists that grew one signup at a time, but contacts you imported or synced in bulk can share a timestamp. Don't pick a value many contacts share, such as country or plan, because anyone who knows the ID could guess it. **Kit** offers **Kit's hashed email (sh_kit)**. Kit adds that value to your email links itself, so you don't choose a field. To turn secure links off, choose **Off** and click **Save**. ## Update your email links ### ActiveCampaign After you choose a value, **Add this to your links** shows the exact ending to paste. For signup date and time it's: ```text ?rm_ac=%SUBSCRIBERID%~%SUBDATE%_%SUBTIME% ``` For a custom field, the part after `~` is that field's personalization tag, such as `%SECURE_CODE%`. If a link already has a `?`, use `&` in its place. Send yourself a test email and check that the delivered link shows a number, a `~`, and the value, with no merge tag left over. Custom field values match regardless of case, spacing, and punctuation. Signup dates match at the precision the link carries, to the day or the minute. ### Kit In Kit, open **Settings**, then **Advanced**, and turn on both **Add subscriber_id parameter in email links** and **Automatically append hashed subscriber email to email links**. Kit then adds `ck_subscriber_id` and `sh_kit` to every link in your broadcasts and sequences, so you don't edit any links. RightMessage checks that `sh_kit` matches the subscriber's email and removes both from the address bar. ## When it takes effect ActiveCampaign checks start as soon as you save. Kit's check needs the latest version of RightMessage on your site, so its option shows a **Needs a publish** badge. After you save, the section is marked "Goes live once you next publish" and shows a **Publish** button. Until you [publish](https://rightmessage.com/help/publishing-your-changes), visitors are recognized as they are now. After that it's marked "Live now". ## What changes for your visitors - **Links in emails you've already sent stop recognizing visitors.** They carry only the contact ID. Update your templates and automations before you turn this on, or expect older emails to land as anonymous visits. - **A returning browser stays recognized.** After a contact's first secure visit, their browser keeps a signed token and sends it on later pages instead of the ID. Changing **Value to check** to another field makes everyone check a link again. - **A Kit `ck_subscriber_id` cookie on its own stops identifying anyone** once the check is live. - **Identifying by email keeps working.** Email questions, forms, and the `email` link parameter still recognize visitors. So does the JavaScript `identifyByEmail` command. `identify` with a bare contact ID doesn't. - **Guessing locks a contact's links for a day.** After five wrong values for one contact within 24 hours, from any address, that contact's links stop working until the day is up. Browsers that already have their token aren't affected. ## Check that it's working 1. Send an updated email to a test contact you control. 2. Open its link in a private window and check the contact in the [debugger](https://rightmessage.com/help/using-the-rightmessage-debugger). 3. In another private window, open the same page with only the ID, such as `?rm_ac=` and the number. The visitor should stay anonymous. If your real link leaves the visitor anonymous, check that the value after `~` matches the contact record, that the merge tag rendered, and, for Kit, that you've published and both Kit settings are on. [Troubleshoot anonymous visitors](https://rightmessage.com/help/why-visitors-appear-as-anonymous-in-your-people-feed) covers other causes.