Our email campaign reported 60 clicks. One was a person.

Between 1 and 21 September 2026 we sent 24 small outreach campaigns, and the dashboards reported about 60 unique clicks — a click rate around 15%, which for cold email would be excellent. Checked on 22 September, exactly one of those clicks was a human being.

The rest were mail security gateways fetching every link in the email before the recipient ever saw it. This isn't a Resend problem or a Groundbase problem. It's true of every email platform that counts clicks, and if you run a one-person business it matters more to you than it does to a marketing team, because you're the one who follows up.

What we sent

A comic strip, by email, to small-business owners. Twenty-four drip campaigns, 35 to 55 emails a day on a domain we were deliberately warming up, sent at the same time each afternoon. Real HTML with real links, nothing unusual.

The tell is the clock

Every click event carries a timestamp, and so does every delivery. Subtract one from the other and the picture stops being ambiguous.

Measured 22 September 2026 across all 24 campaigns.

Two more patterns give it away. Many of the clicks came with zero opens — the link was fetched but the tracking pixel never loaded, which is backwards for a human and normal for a scanner that follows links without rendering images. And some opens carried a timestamp earlier than the delivery that supposedly caused them. A security gateway inspects the message on its way through, so its fingerprints can land before the mail reaches the inbox at all.

The website agreed

One minute after each afternoon send, our comic pages got a burst of visits: desktop Chrome, a browser window exactly 1920 pixels wide, from Microsoft data centres in Boydton, Virginia and Des Moines, Iowa, plus San Jose and Dublin. The same fingerprint every single day. Never a phone. Never a second page. Nobody scrolled, nobody clicked anything else, nobody came back.

That's what an automated link check looks like from the other end.

The one real click

Eighteen hours after delivery, an Android phone opened the email in the Gmail app, read the comic, and clicked through to our home page. The click timestamp from the email platform and the page view on our site match to the minute, and the visit behaves like a person: a phone, two pages, time spent on them.

One confirmed human click out of roughly sixty reported. The other two slow clicks produced no visit at all, which means either a tracker blocker or a delayed rescan — we genuinely don't know, so we count them as "maybe" rather than quietly rounding them up.

The A/B test that measured nothing

We ran two subject lines against each other: "you use the search bar" versus "what's the CRM costing you?". The first reported 6 clicks, the second 4, and the obvious conclusion was that the first subject line won by 50%.

All ten of those clicks were scanners. Scanners don't read subject lines. We had measured which variant happened to reach more heavily-filtered mail servers — a real difference, just not the one we were testing. Any decision made from that test would have been a coin flip dressed as evidence.

Why this hits a one-person business hardest

A marketing team reads a 15% click rate as a number on a chart. You read it as ten people to call.

An owner looking at "10 clicks" follows up with ten people who never saw the email — "just following up on what I sent" to someone with no idea what you mean. That's worse than not following up at all, and it burns the goodwill of the handful of real prospects mixed into the list. The realistic click rate on those 24 campaigns was under 1%. Everything above that line was a machine.

The test you can run on your own numbers

You don't need website analytics to do this. You need the delivery time and the click time.

• Ignore any click that lands within five minutes of delivery. Almost all of them are scanners, and the few real ones you discard don't change any decision you'd make.
• Treat a click with no open as a scanner. A person who clicks a link has usually loaded the images too.
• Distrust an open that arrives at the same second as the delivery. Apple Mail Privacy Protection fetches images ahead of the reader, and Gmail's image proxy caches them, so "opened" often means "a machine touched this".
• Check whether your links are real links. A URL pasted as plain text never gets rewritten for tracking, so genuine clicks on it are invisible. We shipped exactly that bug on 10 September: a campaign reported 0 clicks against 7 opens because both variants pasted a bare URL. The number is wrong in both directions.
• Believe the reply. The one signal nobody can fake on your behalf is a person answering you. During this same stretch, one person replied to a text — and that reply was worth more than all sixty clicks combined.

What Groundbase does and doesn't do here

Being straight about our own product, since this post is about not trusting numbers:

• Campaign open and click tracking is off unless you turn it on. Groundbase never asks your Resend account to track anything; it records the events Resend chooses to send it. If you've never enabled tracking in Resend, your campaign has no open or click numbers at all, which is a defensible place to be.
• Groundbase does not filter scanner clicks today. A click is counted when the event arrives, with no check on how soon after delivery it came. The numbers in the app have the same flaw as everyone else's, and now you know the shape of it.
• A scanner click also manufactures an "open". When a click arrives for someone whose pixel never fired, Groundbase marks them as opened too, on the reasoning that clicking implies opening. For a human that's right. For a gateway it inflates both numbers at once, so opens and clicks aren't independent confirmation of each other.
• Two fixes are under consideration: discounting clicks that arrive within a few minutes of delivery, and tagging campaign links so a visit to your own site can be tied back to the email that produced it. Neither is built, and I'm not going to promise a date.
• One-to-one email has the same weakness. Read receipts and click tracking on individual emails (Email integration) run through the same kind of pixel and redirect, so a scanner marks a personal email as read just as happily. Our own code comment calls clicks "the genuinely useful signal here". Three weeks of data say that comment is optimistic, and it's going to get rewritten.

The Campaigns help article covers how to turn tracking on and what it can and can't tell you.

Who this isn't for

• Anyone on a full marketing platform. HubSpot, Klaviyo and similar tools do some bot-click filtering for you. You'll still see inflated numbers, but you're not starting from raw webhook events.
• Anyone sending at real volume. If you're mailing 50,000 people to find a trend, a 1% error is noise. This post is for people whose entire month is 800 emails, where the difference between 60 clicks and 1 click is the difference between a week of follow-up calls and none.
• Anyone who already ignores these numbers. Plenty of good operators never look at open rates. Nothing here will improve your life.

Where this leaves us

Groundbase is a CRM for one-person businesses that sends email and texts through your own accounts and connects to the AI assistant you already use. We show you the numbers your provider reports, and from now on we'll be clearer about what they're worth.

What we actually changed after measuring this: we stopped reading open rates entirely, we treat a click as interesting only when it's slow, and we judge campaigns by replies and booked calls. Those are harder to collect and impossible to inflate, which is the whole point.

---

Have you measured the delivery-to-click gap on your own sends? I'd like to know whether your numbers look like ours: blog-clicks@groundbasecrm.com — I read every one.