Bot Detection for Email Opens and Clicks

​

Overview

Not every open or click recorded by your Email campaigns comes from an actual human recipient. Sources such as Apple Mail Privacy Protection (MPP), corporate security scanners, and automated link-checking proxies can trigger opens and clicks automatically. Left unfiltered, this activity inflates your metrics, skews Key Performance Indicators (KPIs) like Open rates, Click rates, and Click-to-Open Rate (CTOR) that can incorrectly trigger engagement-based automations (for example, retargeting based on email opens and clicks). Bot Detection allows you to define specific rules to identify non-human activity, including blocklists for known bot user agents and IP addresses, and heuristic rules that flag opens and clicks based on timing and click patterns. You can configure rules separately for Bot opens and Bot clicks, and choose how MoEngage should display these metrics in your campaign analytics and reports.

​

Use Cases

• Accurate campaign performance reporting: Marketing and analytics teams can rely on Open Rate, Click Rate, and CTOR that reflect genuine recipient behavior, instead of being inflated by Apple MPP pre-fetching, image proxies, or automated security scanners.
• Reliable engagement-based segmentation and journeys: Since bot opens and clicks no longer falsely qualify a contact as “engaged,” users aren’t incorrectly moved into engaged segments, win-back flows, or automation branches meant only for real recipient actions.
• Flexibility to handle bot-flagged unsubscribes your way: Bot detection works on a best-effort basis, so a genuine unsubscribe click can occasionally be misclassified as a bot click. This setting puts that decision in your hands: choose to always honor the unsubscribe request even when it’s flagged as a bot, so you never risk retaining someone who wanted out, or choose to ignore bot-flagged unsubscribe clicks so genuine subscribers aren’t suppressed by mistake.
• Cleaner data for downstream reporting: Because bot-adjusted metrics can be viewed separately from totals, teams exporting engagement data to BI tools, dashboards, or CRMs can work with human-only numbers for more accurate customer engagement scoring.

​

Enable Bot Detection

To start filtering bot activity, perform the following steps:

1. Log in to your MoEngage dashboard.
2. Navigate to Settings > Channels > Bot Detection Settings.
3. On the Bot Detection Settings page, under the Email tab, turn on the Detect bots for email opens and clicks toggle so it displays as Enabled.

After enabling, there will be two sub-tabs: Bot opens and Bot clicks. You can configure specific detection rules within each.

​

Configure Bot Opens

Navigate to the Bot opens tab to define how MoEngage identifies and handles bot-driven email opens.

​

Detection Rules

• Detect opens from Apple Mail Privacy Protection: For recipients who have enabled Apple Mail Privacy Protection (MPP), Apple preloads remote content, including tracking pixels, through its own relay servers before the recipient actually opens the email. This preload can happen immediately or after a delay, and it registers as an “open” even though no human has read the email, producing a false engagement signal. Check this box to automatically identify these proxy-generated opens.
• Classify as bot activity if: Use these heuristic rules to flag opens based on when they occur relative to email delivery. Select the checkbox next to a rule to enable it. For a rule with a time threshold, the value and unit fields stay disabled until you select the rule. For details on how MoEngage evaluates these rules, refer to How Heuristic Rules Work.
  • An open is detected within [value] [unit] of the email being delivered.: Classifies an open as bot activity if it occurs within the specified time after the email is delivered. Security scanners and image proxies typically fetch the tracking pixel within seconds of delivery, well before a human recipient could read the email.
    • Value: Enter the threshold duration.
    • Unit: Select seconds or minutes.
    • The maximum threshold is 10 minutes (600 seconds). If you enter a higher value, MoEngage displays the error Opens can be classified as bot opens for up to 10 minutes after the email is delivered. You can’t save your settings until you correct the value.
    • For example, if you set the threshold to 10 minutes and an email is delivered at 5:48 PM, an open recorded at 5:52 PM is classified as a bot open. An open recorded at 6:00 PM is treated as a genuine open.
  • An open is detected before the email being delivered.: Classifies an open as bot activity if it occurs before the email is delivered. A recipient can’t open an email that hasn’t reached their inbox, so an open recorded ahead of delivery indicates automated activity. If MoEngage receives the open event before the delivery event, it compares the event timestamps shared by your email service provider (ESP) to determine which actually occurred first.
• Bot user-agent blocklist: Expand this section to manage the list of user-agent signatures used to detect bots.
  • MoEngage Default: Rules tagged with “MoEngage default” are maintained automatically by MoEngage to cover known bots.These rules cannot be deleted. However, if you find that traffic from a specific default user agent or IP is actually genuine for your brand, you can disable that individual rule at any time using its Enabled checkbox.
  • Search: Use the Search bot user-agent by name field to find specific rules.
  • Add bot user-agent: Click the + Add bot user-agent button to create custom rules. You can add up to 200 entries. This creates a new input row where you must define the following fields:
    • Detection logic:
      • Select Exact match if you want MoEngage to block an open only when the incoming user-agent string matches your entry perfectly, character for character (e.g., 123456).
      • Select Partial match if you want to block an open when the incoming user-agent string simply contains your entry as a substring (e.g., entering random will block any user-agent string that includes the word “random”).
        Use Partial match carefully, an overly broad value can unintentionally match legitimate traffic and misclassify real users as bots. For example, entering Mozilla/5.0 as a partial match would match almost every real browser’s user-agent string, since most legitimate browsers include this substring causing the majority of your genuine opens to be categorized as bots.
      • Both Exact match and Partial match are case-insensitive, so entries like Random and random are treated the same.
    • Bot user-agent name: Type the exact or partial string you want to detect. Note: You must enter a string here before saving, otherwise MoEngage displays a Please enter a user agent string before saving error.
    • Enabled: This checkbox determines the active status of the rule. Leave it checked to activate the rule immediately upon saving. Uncheck it if you want to save the rule to your list but keep it inactive for now.
    • Actions: While adding a new rule, click the checkmark icon to save and apply the new entry, or click the cross (X) icon to cancel and discard the row. After a rule is saved, these icons change to a pencil for editing and a trash can for deleting.
• IP Address blocklist: Expand this section to block opens originating from specific IP addresses or ranges (e.g., corporate proxies or data centers).
  • Click + Add IP address to define the Type (Single IP or IP Range), the Standard (IPv4 or IPv6), and the exact address/range.
  • While adding a new IP address, click the checkmark icon to save and apply the new entry, or click the cross (X) icon to cancel and discard the row. After an IP address is saved, these icons change to a pencil for editing and a trash can for deleting.

​

Post Detection Actions

Under the Post detection actions section on the Bot opens tab, choose your preferred Campaign metrics display settings:

• Show both total and adjusted opens: Your campaign reports will display the raw, unfiltered open counts alongside the adjusted (human-only) open counts.
• Show bot adjusted opens only: Your campaign reports will entirely exclude detected bot opens, showing only the adjusted metrics.

For more information, refer to the Engagement Metrics section in Campaign Performance Stats.

​

Configure Bot Clicks

Navigate to the Bot clicks tab to define how MoEngage identifies and handles automated link-checking bots. Because bots often crawl every link in an email to check for malicious content, they can falsely inflate your Click-Through Rates (CTR) and accidentally trigger unsubscribe links.

​

Detection Rules

This tab utilizes the same blocklist structures as the Bot opens tab, but applies them specifically to link clicks. If you are configuring this for the first time, you will see empty state illustrations prompting you to begin.

• Classify as bot activity if: Use these heuristic rules to flag clicks based on their timing and pattern. Link-scanning bots often follow every link in an email within seconds of delivery, often without loading the email itself. Select the checkbox next to a rule to enable it. For a rule with a time threshold, the value and unit fields stay disabled until you select the rule. For details on how MoEngage evaluates these rules, refer to How Heuristic Rules Work.
  • The first click is detected within [value] [unit] of the email being delivered.: Classifies a click as bot activity if the first click on the email occurs within the specified time after delivery.
    • Value: Enter the threshold duration.
    • Unit: Select seconds or minutes.
    • The maximum threshold is 10 minutes (600 seconds). If you enter a higher value, MoEngage displays the error Clicks can be classified as bot clicks for up to 10 minutes after the email is opened. You can’t save your settings until you correct the value.
    • For example, if you set the threshold to 3 seconds, a click recorded 2 seconds after delivery is classified as a bot click.
  • Two or more links are clicked within [value] [unit] of each other.: Classifies clicks as bot activity if two or more links in the same email are clicked within the specified time of each other. Rapid clicks across multiple links are typical of automated link checkers rather than human readers.
    • Value: Enter the maximum time between clicks.
    • Unit: Select seconds or minutes.
    • The maximum threshold is 10 minutes (600 seconds). If you enter a higher value, MoEngage displays the error Clicks can be classified as bot clicks for up to 10 minutes after the email is opened. You can’t save your settings until you correct the value.
    • For example, if you set the threshold to 3 seconds and one link is clicked and then a second link 1 second later, both clicks are classified as bot clicks.
  • All the links in an email are clicked.: Classifies clicks as bot activity if every link in the email is clicked. Security bots commonly scan every URL in an email for malicious content, while human recipients rarely click every link. This rule has no configurable threshold.
  • A click is detected without the email being opened.: Classifies a click as bot activity if no open has been recorded for the email before the click. Automated link checkers follow links without loading the email’s tracking pixel, so their clicks arrive without a preceding open. If an open is recorded after the click, the click’s classification doesn’t change.
    Do not enable this rule if your database includes contacts subject to CNIL (France/Italy) or similar open-tracking consent regulations, or if a significant portion of your audience uses email clients that block tracking pixels by default. For these contacts, opens aren’t tracked, so their genuine clicks are classified as bot clicks.
  • A click is detected before the email being delivered.: Classifies a click as bot activity if it occurs before the email is delivered. If MoEngage receives the click event before the delivery event, it compares the event timestamps shared by your ESP to determine which actually occurred first.
• Bot user-agent blocklist: Click + Add bot user-agent to input user-agent signatures for known link-crawling bots. You will use the exact same inline inputs (Detection logic, Bot user-agent name, Enabled checkbox, and checkmark/cross Actions) as described in the Bot Opens section.
• IP Address blocklist: Click + Add IP address to block click activity originating from specific servers or data center IP ranges.

​

Post Detection Actions

​

Campaign Metrics Display Settings

Choose how your campaign dashboards present click data:

• Show both total and adjusted clicks: Displays raw counts alongside adjusted (human-only) click counts.
• Show bot adjusted clicks only: Completely excludes detected bot clicks from your reports. (Note: Updating this will also update the setting on the Bot opens tab).

For more information, refer to the Engagement Metrics section in Campaign Performance Stats.

​

On Detecting Unsubscribe Bot Clicks

Because security bots test every link, they will inevitably click your unsubscribe link. This setting protects genuine users from accidental opt-outs.

• Unsubscribe the user: MoEngage will process the opt-out request normally, even if the system suspects it was triggered by a bot.
• Ignore unsubscribe bot clicks: MoEngage will block the opt-out request if a bot click is detected, ensuring the genuine user remains subscribed and reachable.

​

How Heuristic Rules Work

The heuristic rules under Classify as bot activity if on the Bot opens and Bot clicks tabs work as follows:

• Seven rules in total: The Bot opens tab has two heuristic rules and the Bot clicks tab has five. Three of these rules let you set a time threshold: one on Bot opens and two on Bot clicks.
• Threshold limit: A threshold can’t exceed 10 minutes (600 seconds). If you enter a higher value, MoEngage displays a validation error below the rule and you can’t save your settings until you correct the value:
  • On the Bot opens tab: Opens can be classified as bot opens for up to 10 minutes after the email is delivered.
  • On the Bot clicks tab: Clicks can be classified as bot clicks for up to 10 minutes after the email is opened.
• Multiple matching rules: Each enabled rule is evaluated independently, so a single open or click can match more than one rule. MoEngage records every matching rule as a reason on the event. For example, if a bot clicks all three links in an email within seconds of delivery and no open was recorded, the click is flagged for The first click is detected within, All the links in an email are clicked., and A click is detected without the email being opened.
• Classification is final: MoEngage classifies an open or click when the event is processed. Events that arrive later don’t change an earlier classification. For example, an open recorded after a click doesn’t reclassify that click.
• Only enabled rules affect your metrics: Opens and clicks are classified as bot activity in your campaign metrics only for the rules you enable.
• Delivery-based rules: Four rules depend on the email’s delivery event: An open is detected within [value] [unit] of the email being delivered., An open is detected before the email being delivered., The first click is detected within [value] [unit] of the email being delivered., and A click is detected before the email being delivered. How MoEngage evaluates these rules depends on whether it has the delivery event for the email:
  • Delivery event is available: MoEngage compares the event timestamps shared by your ESP. If the open or click occurred before the delivery, it’s classified as bot activity under the corresponding “before the email being delivered” rule. The order in which MoEngage receives the events doesn’t matter; the ESP timestamps decide.
  • Delivery event isn’t available: If the delivery event was never received, or was received too late to be evaluated, MoEngage skips the delivery-based rules for that open or click. MoEngage never classifies an open or click as bot activity just because its delivery event is missing. Other enabled rules, such as the blocklists, Apple MPP detection, and heuristic rules that don’t depend on delivery, still apply.
  • ESPs that don’t send delivery events: Some ESPs, such as Mandrill and SparkPost, don’t send delivery events to MoEngage, so delivery-based rules are never applied to their emails. For more information, refer to the FAQs.

​

Choose a Threshold

Timing-based rules can’t distinguish a fast bot from a fast human. Any genuine recipient who opens or clicks within your threshold is also classified as a bot, even when the action is manual. Before you set a threshold, review how quickly your recipients typically engage after delivery. Start with a short threshold, monitor your adjusted metrics, and increase it gradually if bot activity is still getting through.

​

Save or Disable Bot Detection Settings

Saving: Click the Save button at the bottom right of the screen to apply your configurations. Changes to the Bot opens and Bot clicks tabs are saved independently. If you attempt to navigate away with unsaved changes, MoEngage will prompt you to confirm before discarding them. Disabling: To turn the feature off entirely, switch off the Detect bots for email opens and clicks master toggle. MoEngage will display a confirmation dialog summarizing the impact on your metrics before disabling the rules.

​

FAQs