Sending a proof, and what the customer does

The loop

  1. Staff attach a file to an order and send. The proof is created, version 1 is stored, an approval link is minted, and the customer is emailed.
  2. The customer opens the link. No account, no login. Opening it is recorded — you’ll see when they first looked.
  3. They approve, or they request changes. A comment is required on a change request, so “needs work” never arrives without saying what needs work.
  4. On a decision, the link becomes a read-only receipt. It stops being able to change anything, but it stays openable and the customer can still download the file from it. It never simply 404s the next day — a customer clicking their own link a week later and hitting a dead page is a support ticket nobody wants.
  5. Staff upload version 2. That reopens the proof, re-locks the order if the production lock applies, and clears any earlier lock override — a new version is a new decision to be made, not an old one to be assumed.
  • Default lifetime: 30 days, configurable in Settings.
  • Revoke and reissue in one click. The old link dies immediately. This is the answer to “I sent it to the wrong email address.”
  • Every open is recorded, so a link you forwarded is visible to you rather than silent.
  • Repeat opens inside a 15-minute window count once, so a customer refreshing the page doesn’t fill the record with noise.

What’s recorded when a decision is made

  • Time, in UTC
  • The decision (approved or changes requested)
  • The customer’s comment, if any
  • The exact wording the customer clicked — not a paraphrase
  • A hashed form of their IP address (the raw address is never stored)
  • Their browser’s user agent

This becomes one entry in the approval record, chained to the entry before it.

The approval page itself

The page your customer lands on is standalone — it isn’t a page in your theme, and it can’t be embedded or reused for anything else. A few things worth knowing about it:

  • It works without JavaScript. The plain HTML form checks both a nonce bound to the link and the link itself, so it still functions on a locked-down browser.
  • It’s mobile-first, because most customers are opening this from a phone.
  • It sends noindex, nofollow and no-referrer. The link never leaks through search engines or through a Referer header on an outbound click.
  • It makes no outbound requests of its own. Nothing is called out to, tracked, or logged anywhere except your own site’s database, while an unauthenticated member of the public is looking at it.

Common questions

Can I send the same proof to more than one recipient? The link goes to the customer on the order by default. If you need a second person notified when a decision is made, see the approvaltrail_email_recipients filter in Hooks.

What happens if the customer approves, and then I realize I sent the wrong file? Upload a new version. That reopens the proof and requires a fresh decision — the old approval stays in the record exactly as it happened, it isn’t erased or overwritten.

Does the customer need to create an account? No. That’s the whole point of the tokenized link — see Getting started.

Something here wrong or missing? Tell us and we will fix it.