Agent WranglersEmail security
Keep attackers away from your recipients and readers. Send safe links, single-use sign-in links and no secrets, scripts or risky files, and resist phishing.
- Required 5
- Recommended 1
- Optional 1
- Avoid 1
Required
Never let visitors pick who gets your mail
RequiredForms that send email must never let a visitor choose the recipient or write the message others receive. Limit how much mail any one address can trigger.
Send only links people can trust
RequiredUse HTTPS links on your own domain, and make the visible text match where each link goes. Never use public link shorteners.
Make your mail hard to fake
RequiredNever ask for a password, code or payment detail by email. Send from the same domains and addresses every time, so fakes stand out.
Make sign-in and reset links single-use and short-lived
RequiredA link that signs someone in or resets a password works once, expires within an hour, and holds a long random token.
Keep secrets out of email
RequiredNever send passwords, full card numbers, ID numbers or API keys by email. Email is stored in many places and is hard to delete.
Recommended
Avoid risky attachments
RecommendedSend only document types that are safe to open, such as PDF and images. Link to a signed-in download for anything private or large.
Optional
Sign or encrypt sensitive mail
OptionalFor mail that must stay private or be provably yours, sign or encrypt it with S/MIME or OpenPGP.
Avoid
Send no scripts or forms in email
AvoidDo not put scripts, forms, embedded frames or plugins in email. Mail apps strip or block them, and they look like attacks.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security.