Click Protection

Overview

Click Protection replaces URLs in record fields with safe redirect links. When a user clicks a protected link, bowbridge performs a fresh scan of the original URL before redirecting. If the URL is clean, the user is redirected transparently. If the URL is malicious, a block page is shown with threat details.

How It Works

1. A user clicks a protected redirect link in a record field
2. The system looks up the original URL from the mapping record
3. A fresh scan is performed on the original URL in real time
4. If the URL is clean, the user is redirected to the original destination transparently
5. If the URL is malicious, a block page is displayed with security details and the reason for the block

URL Replacement Examples

When Click Protection is enabled, URLs in record fields are replaced with redirect links that point to a scanning page within your Salesforce org.

Simple Text Field

https://partner-site.com/shared-document

https://yourorg.my.salesforce.com/apex/URLSafeRedirect?id=a1B5g00000AbCdE

Rich Text or Long Text Field with Multiple URLs

Please review the proposal at https://vendor-portal.com/proposal
and the contract at https://legal-docs.com/contract/2026

Please review the proposal at https://yourorg.my.salesforce.com/apex/URLSafeRedirect?id=a1B5g00000AbCdE
and the contract at https://yourorg.my.salesforce.com/apex/URLSafeRedirect?id=a1B5g00000FgHiJ

What Users See When a URL is Blocked

When a user clicks a protected link and the scan detects a threat, a block page is displayed with:

Enabling Click Protection

Click Protection is configured per field in the URL Scan Settings.

Restoring Protected Links

If Click Protection needs to be rolled back for existing records, use Restore All Protected URLs in URL Scan Settings. The restore action rewrites original URLs back into affected records as a background job and writes an Audit Trail entry.

See URL Scan Settings for details.

Adding URL Scanning Triggers to Objects

URL scanning and Click Protection require a Salesforce trigger on each object you want to protect. The trigger fires after records are created or updated and passes control to the URL scanning logic provided by the installed package.

Trigger Code

The trigger code is the same for every object. Only the object name in the trigger definition changes:

trigger YourObjectTrigger on YourObject__c(after insert, after update) {
    Triggers.prepare()
    .bind(YourProvidedUrlScanningHandler.class)
        .afterInsert()
        .afterUpdate()
        .execute();
}

Replace YourObjectTrigger with a descriptive trigger name and YourObject__c with the API name of the object you want to scan.

Examples for Standard Objects

trigger AccountTrigger on Account(after insert, after update) {
    Triggers.prepare()
    .bind(YourProvidedUrlScanningHandler.class)
        .afterInsert()
        .afterUpdate()
        .execute();
}

trigger CaseTrigger on Case(after insert, after update) {
    Triggers.prepare()
    .bind(YourProvidedUrlScanningHandler.class)
        .afterInsert()
        .afterUpdate()
        .execute();
}

trigger LeadTrigger on Lead(after insert, after update) {
    Triggers.prepare()
    .bind(YourProvidedUrlScanningHandler.class)
        .afterInsert()
        .afterUpdate()
        .execute();
}

trigger OpportunityTrigger on Opportunity(after insert, after update) {
    Triggers.prepare()
    .bind(YourProvidedUrlScanningHandler.class)
        .afterInsert()
        .afterUpdate()
        .execute();
}

Deploying Triggers to Production

Apex code cannot be created or edited directly in production orgs. The Salesforce UI for Apex development (Developer Console, Setup) is read only in production environments. To add a new trigger, you must deploy it from a sandbox or local project.

trigger AccountTrigger on Account(after insert, after update) {
    Triggers.prepare()
    .bind(YourProvidedUrlScanningHandler.class)
        .afterInsert()
        .afterUpdate()
        .execute();
}

<?xml version="1.0" encoding="UTF-8"?>
<ApexTrigger xmlns="http://soap.sforce.com/2006/04/metadata">
    <apiVersion>65.0</apiVersion>
    <status>Active</status>
</ApexTrigger>

sf project deploy start --source-dir force-app/main/default/triggers --target-org your-org-alias