The campaign went out at 9:00. By 9:01 a few hundred profiles had clicked every link in it, including the unsubscribe link and the address in the footer. None of them bought anything. Most of them never do.
Those are bot clicks. Klaviyo records them next to the real ones, and what happens after that depends on settings most accounts have never opened.
Last verified: 7 October 2026, against Klaviyo’s help centre.
What bot clicks in Klaviyo are
Klaviyo’s definition: “an email or SMS click performed by a machine, often to verify the safety of a link or display a link preview.” The machines belong to inbox providers, third-party security software and mobile carriers. They follow links to check for phishing before the message reaches a person.
Klaviyo detects these and sets a Bot Click property on each click event to true or false. It does not publish the factors it uses, so you cannot audit the classification, only use it. Detection is automatic. Exclusion is not. You choose whether to remove bot clicks from reporting and attribution, and you filter them in each segment yourself.
They are also not the same as inflated opens. Klaviyo treats Apple Privacy Opens as a separate concept, with separate handling.
Where bot clicks do damage
| Where | What a bot click does |
|---|---|
| Engaged segments | A “clicked in the last 90 days” rule keeps a profile that only a scanner touched |
| Sunset and win-back | The same profile never qualifies as inactive, so it is never suppressed |
| Flow splits and triggers | A “clicked email” branch sends the follow-up meant for interested people |
| A/B tests | The variant with more links can win on scanner clicks |
| Attribution | A purchase can be credited to an email nobody clicked |
The deliverability cost sits in the first two rows. Since Apple’s privacy changes made opens unreliable, the standard advice (ours included) has been to build engagement segments on clicks. That advice holds only if the clicks are human. Otherwise the click-based segment quietly keeps the people your sunset policy exists to remove, and you keep mailing them.
Attribution is the commercial cost. Email attribution without bot clicks covers that side.
How to filter bot clicks in Klaviyo
- Segments. On every Clicked Email or Clicked SMS condition, add the filter
Bot Click equals False. This is the one that protects sending decisions, and it has to be added to each condition. Start with your main engaged segment and your sunset segment. - Reporting and attribution. Klaviyo has an account setting that excludes bot clicks from reporting data and attribution calculations. Klaviyo advises against switching it on while a live campaign or a fixed-date flow experiment is running, because the numbers change underneath the test.
- Flows. Check every conditional split and trigger that uses a click. Point them at a segment built with the filter, or add the filter to the condition.
- History. Bot click data exists from 1 January 2022. A lookback window that reaches before that date cannot be filtered.
After step 1, compare the size of the engaged segment with and without the filter. The difference is the number of profiles you have been treating as engaged on a scanner’s evidence.
What the filter does not tell you
A true or false flag has no middle. Klaviyo does not show how confident it was, or why. Some patterns sit in between: a click a few seconds after delivery from a data-centre address could be a scanner or a fast reader on a corporate VPN.
Signs worth looking at by hand, none of them proof on their own:
- every link in the message clicked, including footer links
- clicks within seconds of delivery
- clicks with no open, session or purchase behind them, repeated across campaigns
- a cluster of the above on one recipient domain
That last one matters if you sell to businesses. Link scanning is a feature of corporate mail security, so B2B lists tend to carry more of it than consumer lists.
InboxEagle’s Bot Finder exists for the gap. It classifies each Klaviyo, Amazon SES and Mailgun event as human, suspicious or bot, with a confidence score and the reasons behind it, and it reads Apple’s privacy prefetch and Microsoft SafeLinks-style patterns in context so real subscribers are not written off.
InboxEagle
See which of your clicks are human
Bot Finder scores every open and click as human, suspicious or bot and shows why. Connect Klaviyo and check your engaged segment against it before the next big send.
Sources
- Understanding bot clicks, Klaviyo. Definition, the Bot Click property, the segment filter, the reporting setting and the 1 January 2022 data limit.