About the LevelUp series: At The Markup, we’re committed to doing everything we can to protect our readers from digital harm, write about the processes we develop, and share our work. We’re constantly working on improving digital security, respecting reader privacy, creating ethical and responsible user experiences, and making sure our site and tools are accessible.

---

The Markup respects our readers’ privacy in everything we do—including the links we use to share our journalism.

We don’t use popular URL shorteners like Bitly, because the tracking that comes along for the ride poses more privacy risks—such as sharing our readers’ click traffic—than we are comfortable with.

Instead, we found an existing privacy-minded URL shortener called Shlink, built a custom WordPress plugin on top of it called Smol Links so our editors could easily generate short URLs themselves, and then hosted it all on server infrastructure we have full control over. Our short links count aggregate clicks only, so our audience team can gauge trends in a way that fits within our privacy constraints.

From day one, our entire organization, and especially our product team, has had a clear and public mandate to avoid tracking technologies to the greatest extent possible—no third-party analytics, no sketchy ad tech, no monetizing visitor data. This means we’re often doing extra due diligence on the services we rely on, and if we don’t find something that fits our privacy requirements, we build our own tools or customize existing systems and host it ourselves. Here’s why and how we approached hosting our own URL shortener.

A popular approach to sharing news links on Twitter—used by The New York Times, BBC News, Yahoo! News, and many others—employs multiple sequential redirects from short URLs. By chaining redirects, news outlets capture audience analytics in different tools, each tracking how many people clicked and who they are. Clicking on a Yahoo! News yhoo.it link posted to Twitter will take you to another short URL at yahoo.trib.al (hosted by analytics service SocialFlow), ultimately redirecting you to the story at news.yahoo.com.

Twitter itself has its own URL shortener, t.co, that automatically tracks clicks to each URL published on its platform. One such click on a news article can be observed by Twitter, Bitly, SocialFlow, the news outlet, and any third-party affiliates those companies have partnered with.

SocialFlow advertises that it has tracked more than 12 billion consumer clicks from more than two billion devices. Bitly similarly advertises 10 billion clicks and scans monthly. The scale of accumulated traffic data is big, the exact amount of tracking that companies deploy isn’t transparent to the public, and the data and short URLs generated are all stored with the analytics or URL shortener company an organization uses. These are some of the reasons why we adopted an open source URL shortener and built Smol Links so it can all be hosted on server infrastructure we have full control over.

The tracking from all those URL redirects also happens before the page loads. Once you’ve actually loaded an article, websites that are willing to host ads will pile on even more tracking through ad trackers, third-party cookies, and canvas fingerprinting. If you’re ever curious to know how websites you visit are tracking you, check out another tool we made: Blacklight.

Not all news outlets rely on short URLs this way, but when links are shared on Twitter, they get automatically shortened using Twitter’s own t.co service, which can’t be turned off. In most cases we post full article URLs to Twitter, and clicks on those links are still tracked by the t.co redirect. There’s nothing we can do about that if we want to tweet our work; all we can do instead is make sure we don’t layer invasive tracking on top of that. Other news outlets like Newsweek and The Guardian also avoid using a short URL in their Twitter updates.

The Markup does occasionally rely on our own short URLs in our Twitter posts, to measure traffic or for aesthetic reasons. We count the number of aggregate clicks on each short URL but do not track individual people or IP addresses. That lets us understand the various sources of our website traffic without invading anyone’s privacy.

Finally, while the tracking that happens in URL redirects is almost imperceptible, like other ad tech that loads on the article page, each redirect slows down the article load time. By eliminating these redirects, we reduce privacy risks while marginally speeding things up.

We’re not interested in building things that already exist, so before writing our own link shortener, we tried to find out whether a privacy-minded tool already existed. So when we found Shlink, an open source URL shortener written by software developer Alejandro Celaya, we decided to use it. Shlink has functionality similar to Bitly’s but is designed to run on one’s own server. Our self-hosted Shlink server takes care of most of the heavy lifting—keeping track of our short URLs and redirecting them to the longer original article URLs.

For example, when you click on mrkup.org/amazon-brands, our Shlink server is what sends you to https://themarkup.org/amazons-advantage/2021/10/14/amazon-puts-its-own-brands-first-above-better-rated-products.

Shlink also includes a feature that avoids tracking our visitors by IP address. When we were testing out the software, we discovered a bug that meant IP addresses were being tracked anyway and logged a request with Celaya to fix it. We appreciated how seriously Celaya took the request, and he fixed the bug in a day. 

The software part that we’ve built on top of Shlink’s URL shortener is a WordPress plugin we’re releasing called Smol Links. The plugin lets our editors create and manage short URLs from our existing WordPress CMS, a user interface they are already familiar with.

The plugin has an option to automatically generate new short URLs anytime a story gets published, which was an essential feature for sending out SMS announcements. The plugin uses WordPress filter hooks to offer more customization possibilities—for example, to append query string arguments to each long URL.

Because mrkup.org is hosted on server infrastructure we have full control over, running code we can observe and modify, it means we have more confidence about what happens to our readers’ click data. It means we are not limited to choosing between the ad-tech panopticon and no traffic insights whatsoever. Smol Links lets us measure where our visitors come from in general without undermining the trust in our privacy promise that we’ve worked hard to earn.

Last year, our audience team wanted to experiment with sending out SMS notifications, announcing via text message whenever we’d publish an article. We ran this experiment for five months and originally set up our own partially disemvoweled domain, mrkup.org, in order to fit article updates within the 160-character limit of a text message.

Another essential feature for sending out SMS announcements was the ability to generate new short URLs anytime a story gets published. That’s what drove us to find Shlink and then build Smol Links on top of it.

After looking at aggregate traffic numbers, we saw that SMS was not a popular way for our readers to get article updates, so we decided to end that experiment. But we continued to use the URL shortener on other social media platforms like Instagram, where hypertext links are not natively supported except as a sticker in Stories.

Join us in building a better World Wide Web, starting with the modest short URL redirect. You can download Smol Links in the WordPress Plugin Directory or download it from GitHub. We look forward to reading your issues and pull requests.

We intend to do more of that work in public, sharing what we know about maintaining privacy-respecting systems and releasing some of the software we’ve written. We hope this effort might encourage others to make a similar investment on behalf of their own website visitors and help us gather feedback about where we might have room for improvement.