Is MailPoet Tracking Your Email? How to Block It

MailPoet is the newsletter plugin behind a huge slice of the "just subscribed to a blog" and "your order has shipped" emails landing in Gmail from small WordPress sites. If you have ever wondered whether MailPoet email tracking is watching you read those messages, the short answer is yes, by default, using the same invisible pixel and link rewriting mechanic as the big commercial email platforms. Here is exactly what MailPoet's own documentation says it collects, what a site owner can turn off, and how to stop it from your side in Gmail.

Key Takeaways

• MailPoet's own blog confirms that each email includes a unique identifying image, and when your email client loads it, MailPoet can know that the user opened the email.
• MailPoet routes click tracking through the sender's own WordPress domain using a ?mailpoet_router endpoint, not a separate MailPoet owned redirect domain like the ones Mailjet or Brevo use.
• MailPoet's Advanced settings include an "Engagement analytics tracking" toggle a site owner can switch off entirely, plus a separate opt out mechanism some senders enable for individual subscribers.
• The plugin runs on more than 500,000 active WordPress installs, according to its wordpress.org listing, putting the tracking pixel behind a large volume of blog and small business newsletters.
• Gblock blocks the pixel and strips tracking parameters from links before they load in Gmail, the same approach it uses for the other email service providers covered in this series.

Does MailPoet Track When You Open an Email?

Yes, and MailPoet is refreshingly direct about how. In a post explaining changes to its analytics, MailPoet's own blog on measuring email campaigns after iOS 15 states plainly: "Each email includes a unique identifying image. When a user opens the email and their email client loads that image, we can know that the user opened the email." That is a textbook tracking pixel, a tiny invisible image request that fires the moment Gmail renders the message and confirms back to the sender's WordPress dashboard that you opened it.

The complication, as MailPoet openly acknowledges, is Apple Mail Privacy Protection. Once Apple started prefetching remote images on delivery instead of waiting for a human to open the message, MailPoet's pixel started firing on Apple's servers rather than a real reader's device, inflating open counts across the entire email industry. MailPoet's response was to split its reporting into two buckets: an estimated human "Opened" figure and a separate "Machine-opened" count, a distinction its knowledge base article on machine opens explains counts opens without an associated user agent as human driven. Gmail offers no equivalent prefetching protection, so when you open a MailPoet newsletter in Gmail, the pixel request still reflects an actual read, tied to your IP address at the moment the request hits the sender's server.

How Does MailPoet's Click Tracking Work?

Here is where MailPoet genuinely differs from most of the platforms in this series. Rather than routing your click through a shared redirect domain the vendor owns, such as mjt.lu for Mailjet or click.brevo.com for Brevo, MailPoet rewrites links to point back at the sender's own WordPress site. A link that would normally read https://example.com/post-name/ becomes something like https://example.com/?mailpoet_router&endpoint=track&action=click&data=..., according to MailPoet's own documentation on links redirecting to the homepage or a 404 page. Click the link, the site's own server logs the click against your subscriber record, then immediately fires an HTTP redirect that sends your browser on to the real destination.

That self hosted design has a real consequence for anyone trying to block it. A blocklist built only around known vendor domains, the kind that works well against mjt.lu or list-manage.com, has nothing to match against here, because every MailPoet site rewrites links using its own domain. Detecting MailPoet tracking reliably means recognizing the mailpoet_router pattern itself, not the domain it happens to live on that day. For developers curious how this compares across platforms, our comparison of Gmail privacy extensions covers how different tools approach domain based versus pattern based blocking.

What Data Does MailPoet Actually Collect?

MailPoet's public documentation is less granular here than platforms like Mailjet or Brevo, which openly document IP logging and geographic breakdowns in their API references. MailPoet's detailed statistics knowledge base article describes a subscriber level Engagement tab showing who opened, who clicked, which links they clicked, and how many times, alongside aggregate open and click percentages for the whole send. It does not advertise a device or city level breakdown the way a dedicated ESP dashboard does.

That does not mean less data physically passes through the wire. Every pixel request and every click redirect is still an HTTP request hitting the site owner's own web server, and standard server logs record the requesting IP address by default, the same way any web request does, whether MailPoet's dashboard chooses to surface that detail or not. The practical difference is who holds it: with Mailjet or Brevo, a well resourced infrastructure company sits on the logs. With MailPoet, it is whoever runs that particular WordPress site, which could be a two person shop with no formal data handling process at all.

Can You Turn MailPoet Tracking Off?

Partially, and the control sits mostly with the sender rather than you. MailPoet's Advanced settings tab includes an "Engagement analytics tracking" toggle that a site owner can switch off entirely, stopping the plugin from collecting open and click statistics for every subscriber on that list. MailPoet's help documentation also notes that this is worth disabling if a sender already tracks links through a separate service, since stacking two tracking layers can also cause broken redirects.

There is a subscriber facing angle too. MailPoet's own statistics article notes that subscribers who opt out of tracking still count as sent, but their opens and clicks are not recorded, which points to an opt out mechanism some senders can expose to their list. Whether you ever see that option depends entirely on whether the specific site sending you email has chosen to turn it on, which in practice means most recipients never encounter it at all.

Why Email Users Should Care

MailPoet is not a shadowy ad tech company. It is newsletter software running on ordinary WordPress sites, which is exactly why the tracking behind it is easy to underestimate. A password manager alert or a phishing filter has nothing to say about a plugin quietly confirming to a blogger's dashboard that you opened their Tuesday newsletter at 6:45 a.m. That gap is precisely what a dedicated email tracker blocker for Gmail is built to close, regardless of whether the pixel came from a Fortune 500 marketing platform or a hobby blog running a free plugin.

The self hosted nature of MailPoet's tracking also means there is no single company you can complain to or opt out of at scale. Unsubscribing from one MailPoet powered newsletter does nothing for the next one you sign up for, because every site runs its own independent instance of the same tracking mechanic.

How Do You Block MailPoet Email Tracking in Gmail?

A few approaches exist, each with real tradeoffs worth knowing before you pick one.

Disable automatic image loading. In Gmail, go to Settings, then General, then Images, and select "Ask before displaying external images." This stops the pixel from firing automatically, but it also hides every legitimate image in every email until you manually approve it, which gets tedious fast once you are past a handful of messages a day.

Check links before clicking. Hovering over a newsletter link before clicking reveals the ?mailpoet_router string in your browser's status bar, confirming the click will be logged. That tells you the click is tracked, but it does nothing to stop the open pixel, and it requires remembering to check every single link.

Use a dedicated tracker blocker. Gblock runs inside Gmail and intercepts tracking pixel requests before they load, without hiding legitimate images or breaking the rest of your inbox. Because its blocklist updates automatically instead of shipping as a fixed, manually maintained list, it is built to adapt as platforms rotate through new domains, which matters for a plugin like MailPoet that hosts its tracking on thousands of different sender domains rather than one predictable vendor address. Gblock also strips known tracking parameters from links, addressing the click side of the equation as well as the open pixel.

How Does Gblock Compare to Ugly Email, PixelBlock, and Proton's Approach?

It is worth naming the alternatives honestly. Ugly Email and PixelBlock were early, genuinely useful Gmail extensions for flagging tracked messages, but both lean on manually curated domain lists, a real limitation against a plugin that rewrites links using each sender's own domain rather than a shared one. Trocker works across browsers and covers pixels from multiple providers with a similar blocklist approach. Proton Mail and HEY take a different route entirely, proxying remote images through their own infrastructure before a message ever reaches you, which hides your IP from senders but requires leaving Gmail as your email client altogether.

Gblock's focus stays narrower on purpose: it works inside Gmail rather than asking you to switch providers, updates its detection automatically, and blocks both the pixel and the tracking parameters in links rather than only flagging a message after the fact. None of this makes it a defense against every tracking method anywhere. It does mean the specific mechanism MailPoet relies on, a pixel that loads on open and a link that redirects through the sender's own tracking endpoint, does not get the chance to report back in the first place.

The Bottom Line

MailPoet joins Mailchimp and the other platforms in this series running a familiar playbook: an invisible pixel for opens, a rewritten link for clicks, and per subscriber logging tied back to your identity. What sets it apart is where that logging happens. Instead of sitting on a large vendor's infrastructure, it sits on the WordPress server of whichever blog or small business sent you the newsletter, which means blocking the mechanism yourself, rather than trusting each individual site to handle your data responsibly, is the more reliable move.