Gravity Forms
+ Email Notification Tracking

Gravity Forms sends the email, but it never tells you whether anyone read it. The Gravity Forms Email Notification Tracking add-on closes that gap: it shows you which of your notification emails were opened and which links in them were clicked, right alongside the entry that triggered them. Turn it on for a form and its HTML notifications are quietly fitted with an invisible tracking pixel for opens and signed redirect links for clicks — nothing about the email a recipient sees changes.

When a notification is opened, the pixel is requested from your own site and the add-on records an open against that entry, with the time it was first seen. When a recipient clicks a link, they pass through a signed redirect on your site, the click is recorded against the entry, and they are sent straight on to the original page. Because the destination is carried inside a signed, tamper-proof token, only the links your site actually wrote can ever be followed — the redirect can never be turned into an open redirect, and a doctored link simply records nothing and still delivers the visitor safely.

Every entry then carries its own engagement: how many times it was opened, how many links were clicked, which links, and when it was first opened. Each form gets a clean summary of its notifications with a sent count, an open rate and a click rate, so you can see at a glance which receipts, confirmations and follow-ups are landing. You stay in control: tracking is opt-in per form, and opens and clicks have separate switches, so you can rewrite links without adding an open pixel if you prefer. It is GravityForms-first — there is no third-party service to sign up for, no API key, and the add-on makes no outside HTTP calls at all. The engagement lives in your own Gravity Forms entry data and the tracking is served entirely from your own site.

When a form with tracking on sends an HTML notification, the add-on runs just before the email leaves. If click tracking is on, every trackable link (http and https links only — mailto:, tel: and in-page anchors are left alone) is rewritten to a redirect URL on your own site that carries a signed token holding the form, the entry, the notification and the original destination. If open tracking is on, an invisible 1x1 image is added before the closing body tag, its URL carrying a signed token for the same entry and notification. A send is counted at that moment. When the recipient opens the email, their mail client requests the pixel from your site; the add-on verifies the token and records an open (keeping the first-open time), then returns a tiny transparent image. When they click a tracked link, your site verifies the token, records the click against the entry and the specific URL, and redirects them to the original page. Opens and clicks roll up into a per-entry record and a per-form, per-notification summary with an open rate and a click rate. Every token is signed with a per-site secret and checked with a constant-time comparison, so a tampered token is rejected: the pixel still returns an image and a click still delivers the visitor (links never break), but nothing is recorded and no arbitrary redirect is possible. The add-on contacts no external service and makes no outside HTTP request.