How to Tell If a PDF Was Forwarded

If you are about to send something you suspect will travel, create a free tracked link with the email gate on before it goes — or open the live demo to see what a reader list looks like first.

What a forward leaves behind, and where it leaves nothing

It depends entirely on how the document left you. A PDF attached to an email is a copy handed over. Once it is in somebody's inbox it can be forwarded, saved to a shared drive or dropped into a chat, and none of that produces a record anywhere you can reach. The forward of the email itself is no better: answers on Microsoft's own Q&A site to exactly this question say the original sender is not notified when a recipient forwards a message, unless the sender is added to the forward.

A link is different because every reader has to come back to you to read. The document renders from a server you chose, so each opening is a request that can be recorded — which pages drew, for how long, on what type of device, from roughly which country. A forwarded link is opened by whoever received it, and that opening lands in the same record as everybody else's. That is the whole mechanism, and it is also its limit: if the reader downloaded the file and forwarded the file, the second reader never touches your link and the record stays silent.

So the useful question is not “was it forwarded” but “did somebody I did not send it to read it through my link”. That second question has evidence, and the evidence varies a great deal in strength.

Five signals, from strongest to weakest

1. A reader on a link you gave to one person. If each recipient gets their own link and a second reader appears on one of them, you know whose link travelled. This is the strongest of the five, because it names the person who passed it on rather than the person who received it. You can do it by hand on the free plan — one link per recipient, within its 50 active links — and the section on Pro below covers when doing it by hand stops making sense.

2. An email address that is not on your send list. With an email gate on, anybody who opens the link types an address first, and an address you never wrote to is the plainest sign a link was passed on. Read it for what it is: typed, not verified. A colleague of your recipient types their own work address; somebody who wants to stay anonymous types something else. The mechanics of the gate and what an address is worth are set out at viewer identification with an email gate.

3. A second address on the same link from the same organisation. Weaker than the first two and often more useful: a proposal that collects your contact's address and then, two days later, a finance or legal address at the same domain has been forwarded internally. That is usually good news, and it is the case for reading forwarding as a buying signal rather than a leak.

4. More readings than recipients, on different days. On a link with no gate this and the fifth signal are all you have, and both are weak. PDFTrackr ties two opens to the same anonymous visitor only inside a single UTC day — the key that groups them is rebuilt every day and the old one discarded, by design, so a reader cannot be followed across days. A reopen tomorrow by the person you sent it to and a first reading tomorrow by somebody they forwarded it to produce the same row.

5. A device type or a country you did not expect. The weakest of the five. The session list shows each reading's device type and an approximate country, so a link sent to one person in one office that is read on a phone in another country the same afternoon is worth a second look. It is not worth a conclusion: the next section is the reason.

What looks like a forward and is not

Four ordinary events produce what looks like a forward, and knowing them saves an awkward email to somebody who did nothing wrong.

• A mail-security scanner. Corporate mail systems rewrite links in inbound mail and scan the destination before the message is delivered, which looks exactly like a click — and it comes from the security service's servers, which need not be anywhere near your recipient. PDFTrackr classifies those opens at session close and excludes them from the counts, and shows what the filter removed rather than quietly shrinking the number.
• A preview card. Chat and preview clients request links in order to build preview cards, so pasting your link into a channel produces a machine request before any person reads. The paste may itself be a forward; the preview request is not a reader.
• The same reader on another day or another device. Read on a laptop in the morning and a phone on the train, or opened again on Thursday, one person produces what looks like two.
• A VPN or a mobile network. A country is attached to where the request came from, and a corporate proxy or a carrier gateway can put that in another country entirely.

The working rule: a signal from the first list with a name attached is evidence; a signal from this list on its own is noise until something else agrees with it. The general account of what a link records, and why, is at what PDF tracking is.

What each way of sending lets you detect

The verdict is ours and it is bounded to these six rows: for a document you want read widely but want to know about when it travels, the pick is a tracked link from PDFTrackr with the email gate on, because it is the row that names an unexpected reader for free without asking anybody to install anything. Where DRM genuinely wins is the copy that has already been saved, which a link cannot see; if a forwarded file must not be opened at all, that is the purchase, and the reader pays for it in friction.

When Pro becomes the right choice

Everything in the first two signals works on the plan that costs nothing — the email gate, page-by-page reading, the device and country on each session, the exclusion of automated opens, 50 active share links and twelve months of history, so a forward discovered in the spring can still be traced in the autumn. For a document sent to three people, making three links by hand is a minute's work.

Pro becomes the right choice when a forward needs a name and your send list is too long to give it one by hand. Bulk personalised links generate one tracked link per recipient in a single pass, so a second reader on anybody's link says whose it was. And once finding out is not enough — when the document should open only for the addresses you nominated, verified by a one-time code — Pro restricts the link so a forwarded copy of it fails instead of quietly succeeding. See both in the demo dashboard before deciding.

Keep reading: what PDF tracking is, how to stop a PDF from being forwarded, and viewer identification with an email gate. Or start with how free PDF tracking works.