Why your file views look too high: bots, link previews and email scanners explained
5 views, 1 reader
bots · previews · scanners
You sent a proposal to one person. Thirty seconds later your link shows a view, from a city they don't live in. Then another. By the afternoon it says five. Did they forward it to the whole team, or is something else going on?
Usually something else. A good share of the “views” on any shared link are not people at all. They are machines checking the link for safety, building a preview, or crawling it. Here is who they are, how to spot them, and how a well-built tracker keeps them out of the numbers that matter.
The usual suspects
1. Chat app link previews
Paste a link into WhatsApp, Slack, iMessage, Telegram, Discord, LinkedIn or X and the app fetches the page to build the little preview card with a title and image. That fetch happens before anyone clicks. Some apps do it once from the sender's device, some from their servers, and some again for every recipient.
2. Email security scanners
Companies run their email through security filters that open every link in a message to check it for phishing or malware before the person sees it. Microsoft Defender for Office 365 (Safe Links), Proofpoint, Mimecast and Barracuda all do this. Some go further and render the page in a real, invisible browser. That is the classic “opened within seconds of sending, from a data centre city” view.
3. Search engines and other crawlers
If your link is posted anywhere public, crawlers will find it: search engines, SEO tools, archive services and uptime monitors.
4. You
Every time you open your own link to check it still works, that is a view. Test once, then leave it alone.
How to spot a fake view by eye
| Sign | Likely cause |
|---|---|
| A view within seconds of sending, before the person could have read your message | Email scanner or link preview |
| Location is a big data centre region rather than where the person is | Security scanner or cloud preview service |
| Time on file of zero or one second | A scanner rendering the page for a moment |
| Several views at the exact same minute | A preview fetched once per recipient |
| A view at 3 a.m. from a country you've never sent to | A crawler |
What a tracker should do about it
Two layers matter: keeping bots out of the count, and keeping brief machine opens out of the averages.
- Count only real page loads. On Link in Seconds a normal link records a view from the viewer page itself once it has loaded in a browser, so a server-side prefetch or a simple fetch that never runs the page is not counted.
- Drop known bots. Crawlers, link-preview fetchers and monitoring tools are recognised by their user agent and removed from every number in the report. The report tells you how many were excluded.
- Flag atypical opens. Some scanners run a full browser, so they look like a person. What gives them away is behaviour. An open that was engaged for under a second and gone within two is flagged as atypical. It still appears in the view count and in Recent views (muted, and marked atypical), but it is kept out of average and median time, completion, bounces, returning visitors and page-by-page attention.
The point of the third rule is that a person who reads your file quickly is never thrown out. Both conditions must hold. Someone who opens your file and leaves after three seconds is a quick bounce, not a bot, and counts as one.
Use the numbers that resist inflation
Raw views are the easiest number to inflate. These hold up much better:
- Average or median time. Scanners don't sit on page 6 for forty seconds. Engaged time only counts while the tab is visible and in focus.
- Completion and pages reached. A preview never gets to page 12.
- Returning visitors. A person who comes back the next day is about as strong a signal as you get.
- Named viewers. If you need certainty, ask for the viewer's email before the file opens. A scanner will not fill in a form.
Why unique visitors can still be off
Unique visitors are told apart by a one-way hash of the network address, never the address itself. That is privacy friendly, but it means two people on the same office Wi-Fi can count as one, and one person who moves from home Wi-Fi to mobile data can count as two. Treat it as a good estimate, not a headcount.
The takeaway
A view in the first minute is very often a machine. A view with a minute of reading, several pages turned and a return visit the next day is a person. Judge interest by time and depth, not by the raw count. Read more on what you can track about a shared file and which page readers stop on.
Quick answers
Why did my link get a view seconds after I sent it?
Usually a machine opened it first: an email security scanner checking the link for phishing, or a chat app building the preview card. These often run from data centre locations, which is why the city can look wrong.
Are bot views counted in my analytics?
Known crawlers, link-preview fetchers and monitoring tools are recognised by their user agent and removed from every number. Scanners that run a real browser are caught by behaviour: an open engaged for under a second and gone within two is flagged as atypical and kept out of all averages, though it still shows in the view count.
Does opening my own link count as a view?
Yes. Every open in a browser counts, including yours. Check the link once after you upload it and avoid reopening it to see if it still works.
What is the most reliable sign that a real person read my file?
Time and depth. A visit with a minute of engaged time, several pages read and a return visit later is a person. For certainty, ask for the viewer's email before the file opens, since a scanner will not fill in a form.
Turn any file into a link in seconds
Upload a PDF, image, video, or ZIP and get a clean, trackable link with a QR code, free.
Try Link in Seconds →