@DenisChenu, I have added a relation to 07494 since a list-unsubscribe feature you are discussing at the ticket could also be another option to temporarily solve this. Unfortunately, Limesurvey is missing both, list unsubscribe and secure opt-out using two-click confirmation.

Opt out need a confirmation.

It's not the cases in 3.X or 5.X ?

Potential systems causing this behavior (not tested) are:
Microsoft Defender Safe Links, Proofpoint, Mimecast, Barracuda

@DenisChenu, at 3.x (and maybe 5.x) there was no confirmation at all. Clicking the link directly lead to opt-out.
At LS 6.x we do have a confirmation button but that gets triggered by some security tools scanning the links as well and users still get opted-out automatically, e.g. at MOPAN, a division of OECD.

Suggested Solution: Implement a Two-Click Opt-Out procedure as follows:
The first click (GET) should only open a neutral confirmation page, without triggering any action.
The actual Opt-Out should only occur via a POST request with a valid CSRF token or other anti-bot mechanism (short-lived token, cookie binding, JavaScript delay).

This would effectively prevent automated link scanners from triggering Opt-Outs and ensure compliance with best practices for secure and user-controlled unsubscribe flows.

At LS 6.x we do have a confirmation button but that gets triggered by some security tools scanning the links as well and users still get opted-out automatically, e.g. at MOPAN, a division of OECD.

OK, click on button/submit (the security system make it mad …)

Suggested Solution: Implement a Two-Click Opt-Out procedure as follows:
The first click (GET) should only open a neutral confirmation page, without triggering any action.
The actual Opt-Out should only occur via a POST request with a valid CSRF token or other anti-bot mechanism (short-lived token, cookie binding, JavaScript delay).

You're right : current button is only a link.

Suggested Solution: Implement a Two-Click Opt-Out procedure as follows:

1. Replace button by a submit button
2. Add a checkbox "I confirm" , add required attribute
3. Action control both : submitted and confirm checked.

Sounds like a plan :-)

@tibor.pacalat: Can you discuss this at the next meeting? We already have complaints by some companies considering Limesurvey useless for closed surveys with opt-out links due to this issue.