# Force Discourse to not visit a link
**URL:** https://meta.discourse.org/t/force-discourse-to-not-visit-a-link/153390
**Category:** Support
**Created:** [31 mei 2020 om 15:08 UTC](https://meta.discourse.org/t/force-discourse-to-not-visit-a-link/153390 "2020-05-31T15:08:15Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Arkshine](https://meta.discourse.org/u/Arkshine)
#### Post date: [31 mei 2020 om 15:08 UTC](https://meta.discourse.org/t/force-discourse-to-not-visit-a-link/153390/1 "2020-05-31T15:08:15Z")
Hi,
I’m using the API to create PMs. The content can contain HTML and with links as well. Among those links, some of them as one-click action link. Basic link example: `..`
The issue is discourse visits any links and triggers those one-click actions.
How do you prevent that? I’m not sure what feature is responsible for that.
Is there some allowed hint we can insert in the HTML to tell Discourse to ignore a link?
Or is there an option I missed?
Note: currently I added a check in the backend to ignore Discourse visit but if possible, would like to avoid relying on this.
Thanks!
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [31 mei 2020 om 17:17 UTC](https://meta.discourse.org/t/force-discourse-to-not-visit-a-link/153390/2 "2020-05-31T17:17:23Z")
You are not supposed to code a link that takes an action by simply visiting the link. That is widely considered exploitable in various ways. The user needs to explicitly confirm the action.
---
### Author:  [@Arkshine](https://meta.discourse.org/u/Arkshine)
#### Post date: [31 mei 2020 om 17:54 UTC](https://meta.discourse.org/t/force-discourse-to-not-visit-a-link/153390/3 "2020-05-31T17:54:57Z")
The context is basically users subscribe to notifications and for legal reason, you are required to append links to allow them to unsubscribe the current notification or all notifications. Those specific links must be one-click action without having the extra steps (login, confirmation, etc). Those links uses a generated token and you can’t exploit them. Users will see the message with those links in their _private_ inbox (discourse, or others such as gmail), confirmation is unwanted for that and not going to help.
My question still stands up, is there a way to tell Discourse to not visit a link? Either through HTML or options?
Regardless of the context, it’s actually interesting to know. If it doesn’t exist, having an option to blacklist domain/urls to avoid unnecessary requests would be quite welcomed.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [31 mei 2020 om 18:02 UTC](https://meta.discourse.org/t/force-discourse-to-not-visit-a-link/153390/4 "2020-05-31T18:02:21Z")
Again: you cannot do that. There are also browser(extension)s and virus scanners that previsit / preload links they encounter on a page.
Any request that causes an actual change on a server must be a POST request per the HTTP specification. So if you have a link, you must lead it to a web page containing a button that performs a POST request. Any other way will lead to obscure issues.
> [@Arkshine](#):
>
> Those specific links must be one-click action
Who says they must be? It is pretty normal for unsubscribe links to lead to a confirmation webpage - for the exact reason I stated above.
---
### Author:  [@Arkshine](https://meta.discourse.org/u/Arkshine)
#### Post date: [31 mei 2020 om 18:11 UTC](https://meta.discourse.org/t/force-discourse-to-not-visit-a-link/153390/5 "2020-05-31T18:11:41Z")
> [@RGJ](#):
>
> There are also browser(extension)s and virus scanners that previsit / preload links they encounter on a page
It’s actually quite a solid reason. I did not think about that. 🤔
> [@RGJ](#):
>
> Who says they must be?
Foremost, my client. 😄
Actually I did a form first, but he wanted a one-click action link.
But you said a very valid point, thanks for pointing me this!