title: Are URLs in emails indexed by search engines so they become publicly searchable?
body: <p>I have read a few questions on here about e-mail clients prefetching URLs in e-mails. An answer to this seems to be to add a new confirmation page, where the user has to click a button to confirm the desired action.</p>
  
  <p>But, <a href="https://stackoverflow.com/a/42147812/11297850">this</a> answer states the following:</p>
  
  <blockquote>
    <p>As of Feb 2017 Outlook (<a href="https://outlook.live.com/" rel="noreferrer">https://outlook.live.com/</a>) scans emails
    arriving in your inbox and it sends all found URLs to Bing, to be
    indexed by Bing crawler.</p>
    
    <p>This effectively makes all one-time use links like
    login/pass-reset/etc useless.</p>
    
    <p>(Users of my service were complaining that one-time login links don't
    work for some of them and it appeared that BingPreview/1.0b is hitting
    the URL before the user even opens the inbox)</p>
    
    <p>Drupal seems to be experiencing the same problem:
    <a href="https://www.drupal.org/node/2828034" rel="noreferrer">https://www.drupal.org/node/2828034</a></p>
  </blockquote>
  
  <p>My major concern is with this statement:</p>
  
  <blockquote>
    <p>As of Feb 2017 Outlook (<a href="https://outlook.live.com/" rel="noreferrer">https://outlook.live.com/</a>) scans emails
    arriving in your inbox and it sends all found URLs to Bing, to be
    indexed by Bing crawler.</p>
  </blockquote>
  
  <p>If this is the case, any URL in an e-mail meant to confirm an action, e.g. confirming a login,  subscription, or unsubscription, can end up searchable in a search engine, if that's whats meant by <code>indexed</code> in the quote above. In this case, it's Bing. Not even a dedicated confirmation page where the user confirms the desired action truly mitigates this.</p>
  
  <h3>Scenario #1</h3>
  
  <p>If I email the user a login link with a one-time token in the URL, that URL will end up in Bing. This token will have a short lifetime, lets say 5 minutes, so I doubt anyone will manage to search on Bing and find the URL before the user clicks it or it expires.</p>
  
  <h3>Scenario #2</h3>
  
  <p>The user gets an e-mail with a link to confirm a subscription. This link is perhaps valid for 24 hours. This might(?) be long enough for someone else to stumble over the link on a search engine and accidentally (or on purpose) confirm the subscription on behalf of the user.</p>
  
  <p>Scenario #2 is not uncommon, it's even best practice to use double opt-in as far as I am aware.</p>
  
  <h3>Scenario #3</h3>
  
  <p>Unsubscribe URLs in the bottom of newsletters. Maybe valid for forever? You don't want this publicly searchable in an search engine.</p>
  
  <p>Assume all the one-time confirmation links land on a confirmation page where the user confirms the desired action.</p>
  
  <p>Is it truly the issue that URLs in e-mails are indexed by search engines, at least Bing? And will they actually end up publicly searchable? If not, what is meant by <code>indexed</code> in the quote above?</p>
  
  <p>I'll add for the sake of completion that I don't think I've had much of a problem with this in my own use of the web, so my gut feeling is that this is unlikely the case.</p>