How to Track Who Opened a Link Accurately

Track who opened a link without guessing

To track who opened a link, choose the sharing method first and the analytics second. Public links show visits. Tagged links show which assigned URL someone used. Only a verified identity, such as an email code, connects the visit to the inbox of a person.

For proposals, decks, demos and client deliverables, it helps to know who opened the link. Then you can time a follow-up. The important part is to claim only what the data proves.

This guide compares four options:

• Public links for easy, anonymous access
• Shared-password links for group-level protection
• Tagged links for recipient-level attribution
• Verified email links for confirmed email access

For each option, the guide shows which real tools record the activity for web pages and for documents.

What it means to track who opened a link accurately

An open is an event. An identity is an attribution, which connects the event to a person. These are different things.

A system can record the time, link, session and technical details of a request. That proves that something requested the URL. It does not prove that a named person was at the keyboard. Corporate security scanners, link-preview services, assistants and forwarded emails all make this unclear.

Four levels of evidence are useful:

Evidence level	What you can reasonably say	What you cannot safely claim
Anonymous open	The public URL was requested	A particular person opened it
Password access	Someone had the URL and the shared password	The intended recipient used them
Tagged-link open	The link assigned to a certain tag was used	The tagged person was the viewer
Verified email access	Someone who controls the verified inbox passed the gate	Their legal identity or job title

IP addresses and browser cookies can tell sessions apart, but they do not reliably identify people. Offices share IP addresses, VPNs change them, and several people can use one device.

For reliable tracking, pick the access method that gives the level of proof that you need.

Public links: track link opens, not people

Public links have the least friction. Anyone with the URL can open them without a password or email address. They suit portfolio samples, public product information, press material and files that you want to spread.

Public-link analytics can still show:

• How many sessions opened the page
• Which pages got attention
• Where visitors came from
• When the activity happened

You can get those numbers in three ways:

• On a static host, turn on the analytics of the host. On Cloudflare Pages, open the project. Go to Metrics. Enable Web Analytics (Cloudflare’s steps). It reports page views and visitors.
• With a general analytics tool on the page, such as Google Analytics, you also get referrers (the pages that sent the visitors) and campaign data.
• With a link shortener, you see click counts for the short link itself, even when the destination is a file that you do not control.

A public sample with 37 opens and 5 downloads has 42 recorded events of two types, not 42 identified people. One visitor can open it many times. Automated link checks also create some opens.

Forwarding is unlimited. Everyone uses the same URL, and all activity goes into one anonymous pool. Use public links for reach. Use a stronger gate for confidential files, private pricing or person-level follow-up.

Shared passwords: can I know who clicked my link?

A shared-password link controls access, but it does not identify visitors. Everyone uses the same secret. If 12 clients know it and the link records 18 opens, you cannot match opens to people.

The access event proves two facts:

1. The visitor had the protected URL.
2. The visitor knew the shared password.

It does not prove where either came from. The recipient can forward both, or a colleague can open the link for them.

Shared passwords suit small groups that need a simple barrier. Examples are a project room, an early design preview, or a temporary file package where individual attribution does not matter. Netlify (on paid plans) and Vercel (Password Protection on Pro and Enterprise) offer site passwords. DocSend and Papermark offer them on document links.

For safer use, follow these rules:

• Create a different password for each project or client group.
• If the material is sensitive, send the password through a separate channel.
• Change the password after team or vendor changes.
• If you need accountability for each person, move to verified email links.

Individual sign-ins give a clearer audit trail (a record of who did what) than one credential that many people share. A password controls entry. It does not identify the visitor.

Tagged links: track link opens by recipient

A tagged link is a unique URL created for one client, stakeholder, campaign or recipient. When someone opens it, the tool credits the activity to that tag.

For example, send one investor a link tagged “Alice” and another investor a link tagged “Marcus”. An open, nine viewed pages and a download on Alice’s link show that someone used her assigned link.

That attribution is useful, but it is not proof of identity. The tag follows the link. If Alice forwards her link to her lawyer, the lawyer’s visit appears under Alice’s tag. Four visits on a tagged link are four recorded visits, not four verified visits by the named person.

You can create tagged links in these tools:

• In DocSend, create a separate link for each recipient. Label it with “Name link (not visible to visitors)” (DocSend link settings).
• In Papermark, use Create New Link on the dashboard of the document for each recipient. Each link has its own name and analytics.
• On a website with Google Analytics, add campaign parameters to the URL of each recipient. An example is ?utm_source=alice&utm_medium=email&utm_campaign=proposal. The values appear in the Traffic acquisition report (Google’s guide). Cloudflare Web Analytics does not log query strings (the part of a URL after the question mark), so it does not separate these links.
• With a link shortener, create one short link for each recipient. Compare the click counts.

Tagged links suit attribution with low friction when forwarding is unlikely or acceptable. Typical uses are:

• Sending different pitch-deck links to several investors
• Seeing which client contact opened a design preview
• Separating traffic from partner campaigns
• Tracking individual outreach without an email gate

Use one tagged link for each recipient. Give the links plain names that your team understands. If forwarding is possible and identity is important, use verified email.

Verified email links: know who opened a link

A verified email link asks the visitor for an email address before they get in. The visitor must prove that they can read that inbox. The tool then connects the activity to that address, not to an anonymous session or a tag.

The sequence is as follows:

1. The recipient opens the shared link.
2. A gate asks for their email address.
3. The service sends a one-time code or verification link to that address.
4. The visitor uses it and gets access.
5. The tool records the access under that address, and it can notify you.

These tools do this:

• Cloudflare Access in front of a Cloudflare Pages site, with the One-time PIN login. You allow addresses with the Emails rule or a domain with Emails ending in. Each login appears in the Access authentication logs with the email, the application and the time. These logs record the login, not what the visitor did on the site afterwards. Our Cloudflare Pages protection guide covers the setup.
• DocSend with “Verify email to view” (Advanced, Advanced Data Rooms and Enterprise plans). Visitors get a verification link that expires after an hour. They must open it on the same device (DocSend email verification).
• Papermark with “Require email verification” (Business plan). You can combine it with “Allow specified viewers” (Papermark link settings).

This is the strongest of the four methods. It proves inbox control at the moment of verification, not legal identity. Shared mailboxes, delegated inboxes, compromised accounts and shared browsers remain possible.

Forwarding works better than with a tagged link. A new visitor must pass the email gate and does not get the name of the first recipient. An allowlist (a list of approved addresses) blocks the addresses that you did not approve. If the gate accepts any verified address, forwarded visitors appear under their own addresses as separate viewers.

Use verified email links for proposals, private decks, client deliverables, due-diligence files and demos where timely, person-level follow-up is important.

A practical workflow to track link opens

1. Decide what you are sharing. A PDF or deck goes to a document-sharing service such as DocSend or Papermark. A website or interactive demo goes on a static host.
2. Choose the access method from the table below.
3. If you need tags, create one link for each recipient. For verified email, set up the email gate and the allowlist.
4. Open the link yourself in a private window. Pass the gate. Then you know what the recipient sees.
5. Send the link through email, chat or your client portal.
6. When the work changes, replace the document behind the same link. For a site, deploy a new version to the same site. The link and its history then stay in one place.

Choose access by job:

Situation	Suggested method	Reason
Freelancer sends a private proposal	Verified email	Connects activity to an email address
Agency shares a draft with a client team	Shared password	Simple group access when individual identity is unnecessary
Founder sends a deck to several investors	One tagged link per investor	Low-friction attribution per recipient
Consultant publishes a sample report	Public link	Easy access and wide distribution

For more about the timing of the follow-up, see how to know when a client opens a proposal.

Read engagement after you know who clicked

Identification tells you who got in. Engagement data tells you what happened next. Document tools record pages viewed, time per page and downloads. DocSend shows page-by-page analytics. Papermark records the seconds spent on each page of each view.

Read these signals in context:

Signal	Reasonable interpretation	Caution
Open	The link or gated page was requested	It can be a preview or an automated scan
Pages viewed	The session reached specific pages	A loaded page does not prove that someone read it
Time per page	Attention went to certain pages	Tools count time differently. DocSend pauses its timer when the visitor leaves the tab
Download	The browser requested the file	It does not prove that someone read the file
Form response	The visitor deliberately sent information	Look at the notice and consent that came with the form

Think of a verified prospect who views 9 of 12 pages and returns the next morning. The prospect spends several minutes on pricing and downloads the proposal. This gives a stronger follow-up signal than a single open. A three-second visit after an open is weak evidence of interest.

Notifications have limits too. DocSend sends its visit email about three minutes after the visit starts. So the time in the email can be much lower than the final figure in the dashboard. Before you read too much into a short visit, look at the dashboard.

Privacy and forwarding limits when you track link opens

Match the tracking to the work. Tell visitors when you collect an email address or record engagement. This is especially important where local law, a contract or company policy requires notice. Data that you never use adds risk and does not improve decisions.

Review these items before you send the link:

Item	What to review	Why it matters
Access mode	Match public, password, tagged or verified access to the file	Too little control can expose client work
Identity claim	Describe only what the chosen method proves	A tag or IP address is not a verified identity
Forwarding	Decide if someone else can receive the URL	Forwarding breaks tagged attribution
Notification	Treat a first open as a prompt to look at activity	Automated systems can create false urgency
Data notice	Explain email collection and analytics in plain language	Visitors need to understand the exchange
Retention	Remove old viewer data when you no longer need it	Smaller data stores reduce privacy risk

Final thoughts on how to track who opened a link

Decide what evidence you need before you send. Public links track anonymous activity. Shared passwords add access control without person-level identity. Tagged links connect activity to assigned URLs, but they can mislead when someone forwards them. Verified email gives the strongest practical answer because it requires control of the inbox.

The honest answer to “who clicked my link?” can be a name, a tag or an anonymous session. Good tracking knows the difference.

Free email addresses
for your AI agents

Each agent gets an address like myagent.x7k2@revdokumail.com. It can receive emails, send replies and store files.

• 3 free mailboxes, each with its own address
• 3,000 incoming and 500 sent emails a month
• 3 GB of storage for attachments and files
• Virus, malware, spam and prompt-injection filter
• Read and reply through API, MCP or CLI

Create free mailbox

You do not need a card.