Shield Deep Links from Email Security Systems

Deep-link merge fields can be used to insert clickable links or URLs into emails sent from the EM system. Some deep links enable the recipient to perform an action (such as accepting or declining an invitation). Some perform a full login to the system and direct the recipient to a specific page. Publications may want to add an extra level of protection to deep links with one or both of the following features.

CAPTCHA landing page

Some email security systems analyze URLs in the body of email messages, automatically clicking them in incoming emails. For emails sent from Editorial Manager, this may result in a deep link being clicked by the security system, thereby accepting or declining an invitation before the recipient actually opens the email.

Publications may configure a landing page to shield deep links from these email security systems. The landing page requires a response from a human user before the Accept or Decline actions of the email deep links are completed in EM.

When the feature is enabled, users are redirected to the landing page when clicking an EM deep link that triggers an action in the system. Once the user checks the box presented on the landing page ("I am a human"), the system processes the response action and proceeds to the confirmation page.

Force login for full deep links

Publications may configure the system to shield deep links that perform a full login to the system. When this feature is enabled, the system will redirect a user who clicks a full-login deep link to the login page. The user will be required to log in before the system redirects to the destination of the deep link.

If both features are enabled, the system will present the login page and not the CAPTCHA landing page for deep links affected by both features.

This table describes impact of two shielding features on deep link merge fields.
Deep Link Merge Field	Affected by CAPTCHA	Affected by Force Login
%ACCEPT_EDITOR_INVITATION%	CAPTCHA	Force Login
%ACCEPT_INVITATION%	CAPTCHA	Force Login
%ACCEPT_REVIEW_INVITATION%	CAPTCHA	Force Login
%ACCEPT_REVIEW_INVITATION_AND_VIEW_REVIEWER_PDF% (partial login)	CAPTCHA
%AGREE_TO_TRANSFER%		Force Login
%ATTACH_FOR_AUTHOR_DEEP_LINK%		Force Login
%ATTACH_FOR_EDITOR_DEEP_LINK%		Force Login
%ATTACH_FOR_REVIEWER_DEEP_LINK%		Force Login
%AUTHOR_PAYMENT_DEEP_LINK%		Force Login
%DECLINE_EDITOR_INVITATION%	CAPTCHA	Force Login
%DECLINE_INVITATION%		Force Login
%DECLINE_TO_TRANSFER% (partial login)	CAPTCHA
%DISCUSSION_DEEP_LINK%		Force Login
%EDITOR_DEEP_LINK%		Force Login
%EDITOR_MAIN_MENU_DEEP_LINK%		Force Login
%EDITOR_NEW_ASSIGNMENTS_FOLDER_DEEP_LINK%		Force Login
%EDITOR_NEW_INVITATIONS_FOLDER_DEEP_LINK%		Force Login
%EDITOR_REMINDER_FOLDER_SUMMARY%		Force Login
%EDITOR_REMINDER_SUBMISSION_LISTS%		Force Login
%EDITOR_REQUIRED_REVIEWS_COMPLETE_FOLDER_DEEP_LINK%		Force Login
%LIVE_REPORT_DEEP_LINK%		Force Login
%OTHERAUTH_DECLINE_DEEP_LINK%	CAPTCHA	Force Login
%OTHERAUTH_VERIFY_DEEP_LINK%	CAPTCHA	Force Login: Under certain conditions based on Article Type configuration: If co-author is required to register and verify, deep link performs full login. If co-author is required only to register, deep link performs partial login, and force login does not apply.
%PENDING_ASSIGNMENTS_DEEP_LINK%		Force Login
%PROD_TASK_DEEP_LINK%		Force Login
%PROD_TASK_EDITOR_PUBLISHER_DEEP_LINK%		Force Login
%REQUEST_REMOVAL_USER_DEEP_LINK%		Force Login
%REVIEWER_DISCUSSION_DEEP_LINK%		Force Login
%REVIEWER_RECOMMENDATION_DEEP_LINK%		Force Login
%REVIEWER_SELECTION_SUMMARY_DEEP_LINK%		Force Login
%SUBMIT_INVITED_MANUSCRIPT%		Force Login
%VIEW_REVIEWER_COMMENTS_FOR_AUTHOR_DEEP_LINK%		Force Login
%VIEW_SUBMISSION% (partial login)	CAPTCHA

To configure:

Go to AdminManager > Configure Deep Links. The two features may be used independently or together.

Check the appropriate setting(s):
- CAPTCHA to Shield Deep Links from Email Security Systems: Check the box next to the setting to enable the landing page to require human user confirmation.
- Force Login for Full Deep Links: Check the box next to the setting to require users to login when accessing the system via a full-login deep link.
When finished, click Submit.