Email security scanners can inadvertently confirm subscriptions by following GET links before the recipient does. The solution is a two-step double opt-in: a GET request renders a confirmation page with a hidden form, while a POST request performs the actual confirmation. Key implementation details include generating a 32-byte random token sent via email, storing only an HMAC hash in the database, using an atomic SQL UPDATE that nullifies the token on success (making it single-use), setting response headers to prevent token leakage (no-store, no-referrer, noindex), keeping the token in the POST body rather than the URL, and expiring pending confirmations after 24 hours via a scheduled cleanup query. CSRF protection is unnecessary since the 256-bit token itself serves as the authorization boundary.
