URL Shortener — best practices

Naming

• Always fill in the title. Six months later "PW spring campaign" tells you what a code was for; aB3x9Kd does not.
• Use a custom code when a human will read it. On a printed flyer or read aloud on the phone, SpringSale beats a random code. Keep the random code for email and social, where nobody types it.
• Remember codes are case-sensitive. aB3x9Kd and Ab3X9kD are different links. If a code will be dictated or typed by hand, choose a custom code in one case only.

Campaign tagging

• Pick from the list before typing a new value. "newsletter", "Newsletter" and "news-letter" are three different campaigns to an analytics tool, and the reporting falls apart. The suggestions exist to stop exactly that.
• Agree on a small vocabulary and stick to it. Lowercase, hyphen-separated, no spaces: spring-sale, not Spring Sale 2026.
• Medium describes the channel, source describes the place. source=newsletter, medium=email. Not the other way round.
• One link per placement. If the same campaign appears in an email and in a Facebook post, make two links with different sources. One shared link cannot tell you which one worked.

One link, one purpose, and reuse it

Because the destination can be changed later, a stable link is an asset. A link named "Current price list" that you re-point every quarter is worth more than a new link each time: the click history stays in one place and nothing you have already sent goes stale.

Pause instead of delete

Deleting is safe — a code never gets reused for something else — but pausing keeps the link visible in the list with its history, which is what you usually want for a campaign that ended.

QR codes on print

• Always download the SVG for print. A PNG enlarged to poster size becomes unscannable; an SVG does not.
• Test the printed code before the run. Scan the proof with two different phones, in the light the code will actually be seen in.
• Do not crop the white border away. The downloaded file already includes the light margin scanners need, and placing the code on a busy photograph defeats it.
• Never delete or pause a link whose QR is printed. The paper outlives the campaign. Re-point it instead.
• Print the short address next to the code so people without a working camera can still type it.

Privacy

• Leave IP storage off. Unique visitors are counted from a one-way salted hash, which is enough for the numbers you actually look at. Turn IP storage on only if you have a concrete reason and a privacy notice that covers it.
• Do not put personal data in the code or the tags. A code like JanPeeters is readable by anyone who receives the link.
• Remember the destination is public. A short link is not a security measure. Anyone with the code can follow it, so never point one at something that should be private.

Your own short domain

• Use a subdomain you do not need for anything else. The files take over every address on that domain that is not an existing file, so do not install them on the domain that hosts your website.
• Set up HTTPS before you print anything. A QR code pointing at an insecure address will warn your customers.
• Keep the downloaded archive. It holds the domain's secret token and cannot be produced a second time.
• Check the Remote Domains screen after setup. "Waiting for first request" means the files are not being reached yet — usually a DNS or upload problem.
• Delete a domain you no longer control. That immediately stops its files from resolving your links, even if they are still on someone else's server.
• Only press Download files again when you intend to re-upload them. Each download issues a new token and retires the previous one.

Sending clicks to another system

• Always set a signing secret and check it on the receiving side. Without one, anybody who learns your address can post fake clicks into your CRM.
• Use an https address. Click data is business data.
• Check the Last delivery line now and then. A receiving system that quietly started refusing calls looks exactly like one that has nothing to report.
• Make the receiving side quick and tolerant. It should accept the call and do its work afterwards, and it must cope with the same click arriving twice.

Permissions

• Grant View and Manage to the people who run campaigns.
• Leave See everyone's links off for larger teams so each person's list stays their own and readable.
• Keep Settings for administrators. Changing the short link address breaks every existing link at once if it is pointed at the wrong host.

Housekeeping

• Check the destinations of anything you have printed. A short link outlives the page it points at; a 404 behind a printed code is money spent for nothing.
• Review the Paused tab once a quarter and delete what nobody will ask about again.