Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion docs/4. Product Features/06. HSM Templates.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
<tr>
<td><b>10 minutes read</b></td>
<td style={{ paddingLeft: '40px' }}><b>Level: Beginner</b></td>
<td style={{ paddingLeft: '40px' }}><b>Last Updated: April 2026</b></td>
<td style={{ paddingLeft: '40px' }}><b>Last Updated: July 2026</b></td>
</tr>
</table>
</h3>
Expand Down Expand Up @@ -139,6 +139,18 @@ Here's a simple explanation with examples:

<img width="503" alt="Screenshot 2024-07-01 at 5 13 14 PM" src="https://github.com/glific/docs/assets/141305477/09ec727f-46bf-4242-a95a-caebb6763491"/>

Tracking clicks on a URL button

WhatsApp does not send any signal back to Glific when a contact taps a URL button - the button simply opens the link on the contact's phone. Because of this, Glific has no way to show you how many contacts clicked a Static or Dynamic URL button.

To track clicks yourself, don't point the button straight at your destination page. Instead:

- Use a Dynamic URL to add a unique value for each contact to the link, for example the contact's ID: `https://yourdomain.org/track/{{1}}`
- Point this link to a redirect page you control, or a link-tracking tool (such as Bitly or Rebrandly), that records every click along with that unique value before sending the contact on to your real destination page.
Comment on lines +148 to +149

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Avoid putting a raw contact ID in the tracking URL.

This can expose a stable user identifier in browser history, request logs, and third-party tracking analytics. Recommend an opaque, random or signed token mapped server-side, and explicitly caution against including PII in the URL.

Proposed wording
-- Use a Dynamic URL to add a unique value for each contact to the link, for example the contact's ID: `https://yourdomain.org/track/{{1}}`
+- Use a Dynamic URL with an opaque, non-PII token mapped to the contact server-side: `https://yourdomain.org/track/{{1}}`
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Use a Dynamic URL to add a unique value for each contact to the link, for example the contact's ID: `https://yourdomain.org/track/{{1}}`
- Point this link to a redirect page you control, or a link-tracking tool (such as Bitly or Rebrandly), that records every click along with that unique value before sending the contact on to your real destination page.
- Use a Dynamic URL with an opaque, non-PII token mapped to the contact server-side: `https://yourdomain.org/track/{{1}}`
- Point this link to a redirect page you control, or a link-tracking tool (such as Bitly or Rebrandly), that records every click along with that unique value before sending the contact on to your real destination page.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/4`. Product Features/06.  HSM Templates.md around lines 148 - 149,
Update the tracking-link guidance near the dynamic URL example to recommend an
opaque random or signed token mapped server-side instead of a raw contact ID.
Explicitly caution against placing contact identifiers or other PII in URLs,
while preserving the redirect and click-tracking workflow.

- Match the recorded clicks back to your contacts using the unique value, to see who opened the link.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Say “clicked,” not “opened.”

A redirect records a click/request; it does not prove that the destination page was opened or consumed. Change this to “see which contacts clicked the link.”

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/4`. Product Features/06.  HSM Templates.md at line 150, Update the
documentation sentence about matching recorded clicks to contacts so it says
“clicked” rather than “opened,” specifically describing which contacts clicked
the link without implying the destination page was opened or consumed.


Please Note : If you need the flow itself to react to whether a contact engaged (for example, to send a different follow-up message), use Quick Reply buttons instead of a URL button. Unlike URL buttons, Quick Reply taps send a response back into the flow and can be captured with a `Wait for Response` node.

j. `Category` - Select the most relevant category from the dropdown. Ex. Utility or Marketing.

- Utility: Used for transactional messages to keep your customers in the loop with essential order updates, shipping status, about their accounts, orders, appointment reminders, and important alerts.
Expand Down
Loading