Whitelisting happysignals.com to Prevent Automated “Robot Surveys”

Background

HappySignals surveys are sent to users after service interactions. Survey emails contain rating links that allow users to provide feedback directly from the email. When a rating link is opened, HappySignals receives the request and can register the selected score as part of the survey response process.

Some email and web security solutions automatically inspect URLs to protect users against malicious links. Depending on the product and its configuration, this inspection can result in the security service making an HTTP request to a HappySignals survey URL without any intentional interaction from the user.

Examples of these mechanisms include:

• URL and link reputation checks

• Pre-click URL validation

• Time-of-click protection

• Automated URL scanning

• Sandboxing and virtual browser technologies

• Automated link analysis

If a security system actively accesses a HappySignals survey rating URL, the request can be interpreted as survey interaction and generate an invalid or unintended response.

In investigated cases, automated URL processing has also resulted in multiple rating URLs belonging to the same survey being accessed within only a few seconds. This is inconsistent with normal manual interaction.

This can:

• Trigger survey interaction without intentional user input

• Create invalid “robot” responses

• Reduce survey data accuracy

• Distort score distributions and Experience metrics

• Make automated activity difficult to distinguish from genuine responses

What to Whitelist

Whitelist the customer-specific HappySignals survey domain used by your organization:

[customertenant].[tenantlocation].happysignals.com

Whitelisting should apply to:

• Email link‑checking and URL‑scanning systems
• Proxy servers and web filters
• Endpoint security agents performing automated link testing
• Sandboxing/virtual browser technologies
• Any “safe link” or “URL rewriting” features in email gateways

Important: The objective is to prevent security software from automatically accessing the survey URL. Simply excluding the domain from URL rewriting might not achieve this.

Microsoft Defender for Office 365 Safe Links

If your organization uses Microsoft Defender for Office 365 Safe Links, additional configuration might be required.

Do not rely only on “Do not rewrite”

Adding the HappySignals URL to Do not rewrite the following URLs in email prevents Safe Links from scanning or wrapping that URL during mail flow.

However, according to Microsoft, URLs on this list might still be checked at the time of click. Microsoft recommends reporting a URL that has been confirmed as safe and creating an allow entry in the Tenant Allow/Block List when the URL should also be excluded from Safe Links processing at the time of click.

Add the HappySignals URL as an allowed URL

For HappySignals survey URLs that your Security team has confirmed as trusted:

1. In the Microsoft Defender portal, navigate to Actions & submissions > Submissions > URLs.
2. Select Submit to Microsoft for analysis.
3. Enter the HappySignals survey URL.
4. Select I've confirmed it's clean.
5. Select Allow this URL.
6. Verify that the allow entry is created in the Tenant Allow/Block List.

Microsoft documents this process for reporting trusted URLs and creating allow entries.

If you also want to prevent URL rewriting, add the appropriate HappySignals URL pattern to Do not rewrite the following URLs in email in the applicable Safe Links policy.

Verify the applicable Safe Links policy

Make sure you modify the configuration that actually applies to the affected recipients.

Microsoft applies Safe Links policies in the following order:

1. Strict Preset Security Policy
2. Standard Preset Security Policy
3. Custom Safe Links policies in priority order
4. Built-in protection

Safe Links protection stops for a recipient after the highest-priority applicable policy is applied. Microsoft also notes that policy changes can take up to 6 hours to take effect.

Other Email and Web Security Solutions

Microsoft Defender for Office 365 is only one example. Other email, endpoint, network, or web security products might also perform automated URL processing.

For other security platforms, ask your Security or Messaging team to verify that the HappySignals survey domain is excluded from mechanisms that actively access the destination URL, such as:

• Automated link following
• Pre-click inspection
• URL detonation
• Sandboxing
• Automated browser access
• Other automated URL-validation mechanisms

If your organization uses multiple security products, check each relevant layer separately.

Disabling URL rewriting alone should not be considered sufficient unless your security solution confirms that the configuration also prevents automated requests to the HappySignals survey URLs.

Why Whitelisting Is Needed

Correctly configuring these exclusions helps ensure that:

• HappySignals survey URLs are not automatically accessed by security software
• Survey interactions represent intentional user actions
• Survey data remains accurate and trustworthy
• Experience metrics and score distributions are not distorted by automated activity

HappySignals application logs can identify incoming requests and suspicious request patterns, but they might not identify which external security product, internal policy, user device, or intermediary initiated the request.

Security Considerations

Any security exception should be reviewed and approved by your organization’s Security team.

We recommend limiting exceptions to the specific HappySignals survey domain or domains used by your organization, rather than broadly disabling URL security controls.

HappySignals survey URLs direct users to survey functionality hosted on the HappySignals platform. The purpose of the exception is specifically to prevent trusted survey URLs from being automatically accessed in a way that could be interpreted as user survey interaction.

Implementation Steps

The exact configuration depends on your security platform, but typically includes:

1. Add [customertenant].[tenantlocation].happysignals.com as a trusted domain.
2. Exclude the domain from URL‑scanning and automated link‑rewriting rules.
3. Disable pre‑clicking or sandboxing of URLs from this domain.
4. Confirm changes propagate to all relevant endpoints and filters.
5. Test by sending a sample HappySignals survey and verifying the link is not scanned.

Validating the Fix

After making the configuration changes, perform a controlled test.

1. Send a new HappySignals survey to a monitored test mailbox.
2. Do not select any rating initially.
3. Verify that no unexpected survey interaction is generated before the test user intentionally responds.
4. Have the test user select one known rating.
5. Confirm that the intentional interaction is recorded correctly.
6. Continue monitoring for unexpected survey activity after the change.

A successful test is a good initial indication, but we recommend monitoring subsequent survey activity before considering the issue resolved.

Additional Notes

• Apply the appropriate exclusions to all HappySignals environments used by your organization.
• Review all security layers capable of accessing URLs automatically.
• Do not assume that disabling URL rewriting also disables URL scanning.
• After changing a security configuration, always perform a controlled test before considering the issue resolved.
• If unexpected responses continue, correlate HappySignals request timestamps with your security and network logs to identify which service is accessing the survey URLs.