One Two Three Send

Author: onetwothreeadmin

  • Sponsored post disclosure templates: what regulators actually require

    Sponsored post disclosure templates: what regulators actually require

    Sponsored post disclosure templates: what regulators actually require
    Photo by Team Nocoloco on Unsplash

    Most solo operators running sponsored content use boilerplate disclosure language they copied from someone else. That works until a brand’s legal team pushes back, a platform flags your post, or you realize the rules vary by country, platform, and even content format.

    The disclosure frameworks aren’t consistent. What satisfies the U.S. Federal Trade Commission doesn’t necessarily meet UK Advertising Standards Authority requirements. Instagram’s branded content tool has different mechanics than a newsletter sponsorship disclosure. And affiliate links sit in a separate category from paid placements, even though many operators lump them together.

    Here’s what the major frameworks actually require, and how to write disclosures that cover you without sounding like a legal disclaimer.

    FTC requirements: clear, conspicuous, and early

    The FTC’s core rule is simple: disclose material connections before someone engages with your recommendation. That means the disclosure has to appear before the call-to-action, not buried at the bottom of a 2,000-word post.

    “Clear and conspicuous” has specific meaning. The disclosure needs to be:

    • In plain language—”This post is sponsored by [Brand]” works; “In partnership with” is ambiguous
    • Unavoidable—not hidden behind a “read more” fold or a link labeled “legal”
    • In the same format as the content—if your post is a video, the disclosure needs to be spoken and on-screen, not just in the description

    For newsletters, that usually means a line at the top: “Today’s issue is sponsored by [Brand].” Some operators put it in the subject line using brackets or prefixes; that satisfies the “before engagement” rule because the subject is visible before the open.

    Affiliate links need disclosure too, but the language can be lighter: “This post contains affiliate links. I earn a commission if you purchase.” The FTC cares that readers know you have a financial incentive—not the exact commission structure.

    ASA and UK-specific rules

    The UK’s Advertising Standards Authority is stricter about labeling. The word “ad” needs to appear prominently. “Sponsored,” “partner,” and “collab” don’t meet the standard on their own.

    If you’re running sponsored content and have UK readers, use “Ad:” or “Advertisement:” as a prefix in the subject line or headline. The ASA has flagged Instagram posts where “#ad” appeared several hashtags deep—the rule is that it needs to be upfront, not mixed into a list.

    For newsletters with international audiences, the safest approach is to satisfy the stricter standard. Leading with “Ad:” in the subject and “This issue is an advertisement for [Brand]” in the body covers both FTC and ASA requirements.

    Platform-specific branded content tools

    Instagram, Facebook, YouTube, and TikTok all have built-in branded content toggles. When you enable them, the platform adds its own “Paid partnership with [Brand]” label.

    Using the platform tool doesn’t eliminate your obligation to disclose in your own words—it’s additive. The FTC and ASA expect you to make the disclosure, not rely on a platform label that could change or disappear in a layout update.

    The platform tools do serve a separate purpose: they let brands access performance data through Meta’s Brand Collabs Manager or YouTube’s brand analytics. If a sponsor requires that data access, you need to use the platform toggle. Just don’t treat it as your only disclosure.

    Writing disclosures that don’t kill your voice

    Legal-sounding language makes readers skip the content entirely. You can stay compliant without sounding like a Terms of Service page.

    Instead of: “The following content has been underwritten by a third-party commercial entity in exchange for monetary or other consideration.”

    Use: “This issue is sponsored by [Brand]. They’re paying me to tell you about [Product].”

    The second version is clearer, more honest, and meets every regulatory standard. Readers appreciate directness. The sponsors who push back on plain-language disclosures are usually the ones trying to obscure the commercial relationship—which is exactly what regulators are trying to prevent.

    For affiliate links, the same principle applies. “I earn a commission if you buy” is clearer than “This post may contain affiliate links to products and services, for which the author may receive compensation.”

    Where operators actually get flagged

    Most enforcement isn’t about missing disclosures—it’s about disclosures that appear too late or use ambiguous language.

    Common mistakes:

    • Placing “Sponsored by [Brand]” only in the footer of a newsletter
    • Using “Thanks to [Brand] for supporting this post” without clarifying it’s a paid relationship
    • Disclosing on your website’s generic “Disclaimers” page instead of in the content itself
    • Using platform hashtags like #partner or #collab, which don’t explicitly state a paid relationship

    If you’re running a newsletter with recurring sponsors, disclosing once in your welcome email or about page doesn’t cover individual sponsored issues. Each piece of sponsored content needs its own disclosure.

    One template that works everywhere

    If you want a single disclosure format that satisfies FTC, ASA, and platform norms across newsletters, blog posts, and social media:

    Subject line or headline: “Ad: [Your usual title]”

    Opening line: “This [post/issue/video] is a paid advertisement for [Brand]. They compensated me to [describe what you’re doing: reviewing, recommending, featuring].”

    That structure is unambiguous, front-loaded, and uses plain language. It works for newsletters sent via Beehiiv, MailerLite, or Postmark. It works for blog posts. It works for Instagram captions and YouTube descriptions.

    You can adjust tone—”[Brand] paid me to write this” vs. “This issue is sponsored by [Brand]”—but the core elements stay the same: who paid, what the relationship is, and disclosure before the pitch.

    One Two Three Send covers the operational side of running content businesses—including the legal and platform mechanics most guides skip. Subscribe to get one focused piece like this each day.

    Heads up — some links in this article are affiliate links. If you sign up through them, we may earn a small commission at no extra cost to you. We only recommend tools we use ourselves.

  • Newsletter double opt-in: when confirmed subscribers hurt growth more than spam

    Newsletter double opt-in: when confirmed subscribers hurt growth more than spam

    Newsletter double opt-in: when confirmed subscribers hurt growth more than spam
    Photo by Jacob Padilla on Unsplash

    Most newsletter advice treats double opt-in as gospel: make subscribers confirm their email address before you send them anything. It cuts spam, protects deliverability, and proves intent.

    But it also kills between 20% and 40% of legitimate signups who never click the confirmation link—not because they’re uninterested, but because the email lands in spam, they forget, or friction wins.

    The question isn’t whether double opt-in is safer. It is. The question is whether that safety is worth the subscribers you’re losing before you ever get a chance to send them anything useful.

    What double opt-in actually costs

    When someone submits your signup form with single opt-in, they’re added to your list immediately. You send them a welcome email. They read it or they don’t.

    With double opt-in, they submit the form, receive a confirmation email, and must click a link before you’re allowed to send them anything else. If they don’t click within a set window—usually 24 to 72 hours—they never make it onto your list.

    Industry averages show confirmation rates between 60% and 80%. That means for every 100 signups, you’re losing 20 to 40 people who filled out your form but never confirmed.

    Some of those are bots, typos, or low-intent submissions. But many are real people whose confirmation email went to spam, got buried, or arrived during a moment when they’d already moved on.

    If you’re running paid acquisition, that’s ad spend converted into nothing. If you’re growing organically, it’s momentum you worked for and didn’t capture.

    When single opt-in makes sense

    Single opt-in works best when you control the signup context and the cost of a bad email address is low.

    If you’re collecting signups at the end of a blog post, in a lead magnet download flow, or embedded in a tool someone just used, intent is high and the person is present. They want the thing you’re offering right now. Making them wait and hunt for a confirmation link adds friction exactly when they’re most engaged.

    Single opt-in also makes sense if you’re paying for traffic. Whether that’s Facebook ads, Twitter promoted posts, or sponsored placements, every unconfirmed signup is wasted money. You’re optimizing your funnel to convert clicks into subscribers, and double opt-in chops your conversion rate without improving the quality of traffic you’re buying.

    Platforms like Beehiiv and MailerLite both default to double opt-in but let you switch to single opt-in in settings. If your welcome email has a strong call-to-action—download this, read that, reply here—you’ll know within the first send whether someone is engaged. A confirmation email doesn’t tell you more than that first real message does.

    When double opt-in is worth the friction

    Double opt-in makes sense when list quality matters more than list size, or when you’re in a high-risk deliverability environment.

    If you’re sending sponsorship pitches, cold outreach, or anything that could trigger spam complaints, every bad address on your list is a threat to your sender reputation. Double opt-in filters out typos, role addresses, and people who weren’t paying attention.

    It’s also essential if you’re in a regulated space—anything involving GDPR, health data, or financial services. Proving that someone explicitly confirmed their subscription is a legal safeguard, not just a best practice.

    And if you’re growing through co-marketing, giveaways, or partnerships where someone else is driving signups, double opt-in protects you from low-intent submissions. A partner might send you 500 email addresses, but if only 200 confirm, you’ve learned something important about the quality of that traffic before it damages your open rates.

    The hybrid approach: single opt-in with a cleanup sequence

    You don’t have to choose between growth and quality. Single opt-in gets people on your list immediately, and a well-designed welcome sequence filters out the dead weight within the first week.

    Send your welcome email immediately after signup. If someone doesn’t open it within 48 hours, send a short follow-up: “Did you mean to subscribe?” If they don’t engage with either message, tag them as inactive and stop sending.

    This approach captures the high-intent signups who would’ve confirmed anyway, while identifying the low-quality ones before they drag down your metrics. You’re not asking people to confirm—they confirm by opening, clicking, or replying.

    Most platforms let you automate this. In MailerLite, you can trigger a conditional sequence based on whether someone opened the first email. In Beehiiv, you can tag non-openers and exclude them from future sends.

    The result is a list that grows faster than double opt-in would allow, but cleans itself before unengaged subscribers become a long-term problem.

    Want more breakdowns like this? Subscribe to One Two Three Send and get one operator-focused article like this in your inbox daily.

    Heads up — some links in this article are affiliate links. If you sign up through them, we may earn a small commission at no extra cost to you. We only recommend tools we use ourselves.

  • Zapier’s multi-step Zap limit: when to split automation vs. upgrade

    Zapier’s multi-step Zap limit: when to split automation vs. upgrade

    Zapier's multi-step Zap limit: when to split automation vs. upgrade
    Photo: Killy Ridols via Wikimedia Commons (CC BY-SA 2.0)

    Zapier’s free plan gives you single-step Zaps. The Starter plan ($29.99/month as of mid-2026) unlocks multi-step Zaps—but caps you at three steps per Zap. Professional ($73.50/month) raises that to unlimited steps, plus paths, filters, and formatters.

    Most solo operators hit the three-step wall within weeks. You want to add one more formatter, log the result to a spreadsheet, or trigger a secondary notification—and suddenly you’re staring at an upgrade prompt.

    Before you pay $44 more per month, understand when splitting or nesting workflows makes more sense, and when the upgrade is the only clean path forward.

    When three steps is actually enough

    A surprising number of automations don’t need more than three steps if you structure them correctly. The typical pattern: trigger, action, notification. For example:

    • New Stripe payment → add customer to MailerLite → send Slack message
    • Google Form submission → create Notion database entry → email confirmation via Gmail
    • RSS feed update → post to WordPress → tweet via Twitter API

    If your workflow is linear—one thing happens, then another, then a third—three steps covers it. The problem arises when you need conditional logic, data transformation, or parallel actions.

    Split workflows by trigger source

    If you’re hitting the step limit because you’re trying to handle multiple scenarios in one Zap, split by trigger instead. Create separate Zaps for each entry point.

    Example: you want new Beehiiv subscribers to go into MailerLite, but also want to log high-value signups (identified by a custom field) to a Google Sheet and send yourself a Slack alert.

    Don’t cram conditional paths into one Zap. Instead:

    • Zap 1: Beehiiv subscriber → MailerLite (runs for everyone)
    • Zap 2: Beehiiv subscriber (filtered by custom field) → Google Sheets → Slack

    Both Zaps trigger on the same event. Zapier will fire both. You pay per task (each trigger instance), not per Zap, so the task count is identical whether you use one Zap or two. The Starter plan gives you 750 tasks/month; splitting workflows doesn’t burn through that faster.

    Nest Zaps using webhooks

    Zapier’s webhook step lets one Zap trigger another. This is the workaround for chaining complex workflows without upgrading.

    Set up Zap 1 to handle the first three steps, then send a POST request via webhook to Zap 2’s webhook trigger URL. Zap 2 picks up the payload and continues the workflow.

    Each webhook request counts as one task in the sending Zap and one task in the receiving Zap. If your original six-step automation now runs as two three-step Zaps linked by webhook, you’re using two tasks per full workflow instead of one—but you’re still under the Starter tier’s step limit.

    The tradeoff: debugging gets harder. Webhook payloads require manual formatting (Zapier’s webhook module doesn’t auto-map fields), and if Zap 2 fails, Zap 1 has already completed—there’s no rollback.

    When you should just upgrade

    Upgrade to Professional ($73.50/month) when:

    • You need paths—Zapier’s built-in conditional branching. Paths let one Zap handle multiple scenarios (e.g., route paid customers one way, free subscribers another) without splitting into separate Zaps or nesting webhooks.
    • You need multiple filters or formatters mid-workflow. The Starter plan technically allows filters and formatters, but they count as steps. If you need to parse a date, trim whitespace, check two conditions, and then act, you’ve burned four steps before doing anything useful.
    • Your task volume exceeds 750/month. Professional gives you 2,000 tasks, and the per-task overage cost drops from $0.03 to $0.01.

    For a solo operator running a content business, the math usually tips at around five active multi-step workflows. Below that, split and nest. Above that, the time cost of maintaining fragile webhook chains exceeds the $44/month upgrade cost.

    One non-obvious tip

    If you’re on Starter and splitting workflows, turn on email notifications for failed Zaps in your Zapier account settings. When you nest Zaps via webhook, a failure in the downstream Zap won’t surface in the upstream Zap’s task history—you’ll only catch it if you’re monitoring both.

    Zapier’s default is to email you after the second consecutive failure. Change that to notify on the first failure for any Zap that’s part of a nested chain. The extra emails are worth it when a broken webhook silently drops half your automation.

    Want more breakdowns like this? Subscribe to One Two Three Send for weekly deep-dives on the tools that run online businesses—no fluff, just the details platforms don’t document.

    Heads up — some links in this article are affiliate links. If you sign up through them, we may earn a small commission at no extra cost to you. We only recommend tools we use ourselves.

  • AI writing prompt chains: when to split one request into three

    AI writing prompt chains: when to split one request into three

    AI writing prompt chains: when to split one request into three
    Photo by Jackson Simmer on Unsplash

    Most solo operators treat AI writing tools like search engines: type a request, hit enter, hope for the best. When the output is vague or generic, they blame the model or rewrite the prompt with more adjectives.

    The actual problem is structural. You asked one prompt to do three jobs—research a topic, adopt a voice, and format output—and the model optimized for speed, not depth.

    Prompt chaining splits a single complex request into a sequence of smaller, focused prompts. Each step produces an output that becomes context for the next. It takes longer to set up, but the quality gap is measurable.

    When a single prompt isn’t enough

    If your request includes the word “and” more than twice, you’re asking too much. A prompt like “Write a blog post about email deliverability and make it conversational and include three examples and format it with subheadings” forces the model to juggle competing priorities.

    AI models don’t multitask well. They process tokens sequentially. When you load a prompt with multiple instructions, the model allocates attention unevenly. Formatting often wins over substance. You get clean HTML wrapped around shallow ideas.

    Prompt chains work better for:

    • Long-form content (800+ words) where structure matters
    • Technical topics that need accurate detail before stylistic polish
    • Repurposing existing content into a new format or voice
    • Iterative edits where you want control over what changes

    If you’re generating a tweet or a subject line, a single prompt is fine. For anything that represents your expertise to an audience, chain it.

    How to structure a three-prompt chain

    Start with research and structure. Your first prompt should ignore voice and formatting entirely. Ask the model to outline key points, list examples, or extract the core argument from source material you provide.

    Example first prompt: “List eight specific reasons email deliverability degrades over time for solo operators. Focus on technical causes, not general advice. No introduction.”

    The output will be dry and mechanical. That’s correct. You’re building the skeleton.

    Second prompt: expand and refine. Take the list from step one, paste it into a new prompt, and ask the model to develop each point with specifics. This is where you add constraints like word count, example requirements, or technical depth.

    Example: “Take this list and expand each point into 2–3 sentences. Include one concrete example or number per point. Write for someone who manages their own email infrastructure.”

    Third prompt: apply voice and format. Paste the expanded draft and ask for stylistic changes, structural tweaks, or HTML formatting. Keep the edits narrow—if you ask for voice and reorganization and new examples, you’re back to a multi-job prompt.

    Example: “Rewrite this in a direct, operator-to-operator voice. Use H2 subheadings for each of the eight points. Keep all examples and numbers intact.”

    Each step produces a tangible artifact you can evaluate before moving forward. If step one misses the mark, you catch it before spending tokens on polish.

    The handoff is where quality breaks

    Prompt chains fail when you don’t carry enough context forward. If your second prompt just says “expand this,” the model has no memory of why you wanted those eight points or who the audience is.

    Always restate key constraints in every prompt. Audience, purpose, and scope should appear in each step, even if they feel redundant. Claude and GPT-4 handle long context windows well, but they still weight recent tokens more heavily. If your formatting request is three prompts deep, remind the model what the content is for.

    Copy-paste the output from the previous step directly into the next prompt. Don’t summarize it or assume the model will infer continuity. The chain only works if each link sees exactly what the prior step produced.

    If you’re using Claude, the Projects feature can store your chain structure as reusable templates. Set up a project with your three-prompt sequence, and each new piece of content follows the same quality path without rewriting instructions from scratch.

    When to skip chaining and use a single prompt

    Chaining adds friction. If you’re drafting something disposable—internal notes, a rough outline for your own use, a placeholder headline—don’t bother. Single prompts are faster and good enough for low-stakes work.

    Chaining also doesn’t fix a bad brief. If you don’t know what you want in step one, splitting the request into three steps just produces three mediocre outputs instead of one. Do the thinking before you write the first prompt.

    For most operators, the inflection point is around 500 words and one hour of expected reader attention. Below that, single prompts are fine. Above it, chain.

    If you want to see how other solo operators are structuring their AI workflows—and what’s working in practice—subscribe to One Two Three Send. Every issue covers one specific tool, tactic, or operational decision for people running content businesses.

    Heads up — some links in this article are affiliate links. If you sign up through them, we may earn a small commission at no extra cost to you. We only recommend tools we use ourselves.

  • SEO content briefs: when keyword clusters hide topic gaps

    Most SEO content briefs start the same way: export a keyword cluster from Ahrefs or Semrush, group by search intent, then write to the highest-volume terms. The assumption is that if you cover the keywords, you cover the topic.

    That works until you publish, rank on page two, and wonder why engagement stays flat. The problem isn’t your on-page SEO—it’s that keyword clusters surface search behavior, not reader need. And the gap between the two costs you traffic you should own.

    What keyword clustering actually shows

    Keyword research tools group queries by semantic similarity and SERP overlap. If “WordPress caching plugin” and “best cache plugin WordPress” return similar results, they land in the same cluster. The tool assumes they represent one topic.

    But clustering collapses nuance. A solo operator searching “WordPress caching plugin” might want a feature comparison. Someone typing “best cache plugin WordPress” might need a recommendation for shared hosting with 512 MB RAM. Same cluster, different jobs to be done.

    When you write to the cluster instead of the underlying question, you produce content that ranks for some queries and satisfies none of them completely. Google notices. Your bounce rate climbs. Your rankings stall.

    Where topic gaps hide

    Three places keyword tools consistently miss context:

    Question variants that don’t share keywords. “Why does my site slow down after enabling caching?” and “WordPress cache plugin makes site slower” describe the same problem, but most tools won’t group them. If your brief only covers the positive case—how caching improves speed—you miss readers troubleshooting the opposite.

    Implementation steps buried in forums. High-volume keywords like “WordPress cache setup” get clustered. But the specific friction points—”cache plugin breaks checkout page,” “how to exclude URLs from cache”—live in Reddit threads and support tickets, not keyword reports. If you don’t surface those preemptively, your guide stays shallow.

    Comparison queries across categories. Someone evaluating caching might also search “CDN vs caching plugin” or “caching plugin vs managed WordPress host.” Keyword tools treat those as separate topics. But your reader is solving one problem: site speed. If your content doesn’t acknowledge the adjacent decision, you send them to a competitor’s comparison post.

    How to audit a brief for topic gaps

    Before you write, cross-reference your keyword cluster against three sources:

    People Also Ask boxes for your primary keyword. Google surfaces questions that didn’t make it into your cluster. If five PAA questions address plugin conflicts and your brief doesn’t mention conflicts, add a section.

    Support forum threads for the tools you’re covering. Search the plugin’s own support forum or Reddit for your topic. Sort by recent activity. The questions that appear repeatedly in the last 90 days are the ones keyword tools undercount—because searchers phrase them a dozen different ways.

    Competitor content that outranks your target keyword. Open the top three organic results. Skim their H2s. If two of them cover a subtopic your brief omits—say, “how to clear cache automatically”—that’s a signal. Either the SERP is shifting, or your cluster missed a question searchers expect answered.

    This audit adds 20 minutes to your brief process. It routinely surfaces two or three subtopics that change whether a post becomes a bookmark or a bounce.

    What this looks like in practice

    A client brief for “email service provider for small business” included 18 keywords, all variations on provider names, pricing, and features. The cluster topped out at 1,200 monthly searches.

    The PAA box surfaced “can I use Gmail as an email service provider” and “difference between transactional and marketing email.” Neither phrase appeared in the keyword export. Both questions represented decision points that determined whether a reader would even evaluate the tools in the article.

    We added two sections: one explaining why Gmail’s sending limits break at scale, one defining transactional vs. marketing email with named examples—Postmark for transactional, MailerLite for marketing. The post ranked #3 within six weeks. Average time on page ran 4:20, well above the site median.

    The keyword cluster gave us the semantic frame. The topic gaps gave us the utility.

    The brief is a hypothesis, not a spec

    Keyword research tells you what people searched yesterday. It doesn’t tell you what they needed, what confused them, or what adjacent question determined whether they acted.

    If your content process stops at clustering, you’re writing to the average of past behavior. The posts that rank and convert are the ones that close the gap between the search and the need.

    Run the audit. Add the missing sections. You’ll know it worked when your dwell time climbs and your internal link clicks go up—because readers stay to find the answer they didn’t know how to search for.

    Reply with the last keyword cluster that didn’t convert the way you expected—we’ll feature operator audits in an upcoming piece.

  • WordPress multisite user roles: when admin doesn’t mean super admin

    WordPress multisite user roles: when admin doesn’t mean super admin

    WordPress multisite user roles: when admin doesn't mean super admin
    Photo: Matinbeigi via Wikimedia Commons (CC BY-SA 4.0)

    WordPress multisite introduces a permissions layer most solo operators don’t expect: the distinction between a site administrator and a network super admin. If you’ve ever granted someone “admin” access and watched them fail to install plugins, or wondered why a client can’t manage billing when they “own” their site, this is why.

    The role split isn’t a bug. It’s architectural. But it catches people off guard because single-site WordPress collapses these into one role, and most multisite documentation assumes you’re running a university network, not a cluster of client sites or a portfolio of properties you manage alone.

    What each role actually controls

    A site administrator has full control over content, users, themes, and settings within a single site on the network. They can publish posts, moderate comments, manage menus, assign roles to other users on that site, and switch between themes—if you’ve allowed theme switching at the network level.

    They cannot install or activate plugins, install new themes, edit PHP files via the theme editor (even if it’s enabled), access the network admin dashboard, or create new sites. Those permissions belong exclusively to the super admin.

    A super admin controls the entire network. They can create and delete sites, install and network-activate plugins, upload themes, manage network-wide settings, and promote or demote users across all sites. They also inherit site-level admin privileges on every site in the network, whether explicitly assigned or not.

    If you’re running a multisite as a solo operator—maybe you manage five niche content sites under one installation, or you host client projects—you’re almost certainly the only super admin. Everyone else, including clients who “own” their site, is a site administrator at best.

    When role confusion breaks workflows

    The most common issue: a client or collaborator reports they can’t install a plugin you told them to use. You check their account, see “Administrator” next to their name, and assume the platform is broken. It’s not. They’re a site admin, not a super admin, and multisite doesn’t let site admins touch plugins by default.

    The second surprise: user management. A site administrator can add users and assign roles on their site, but they can’t remove a user from the network entirely. If someone needs to be deleted—not just demoted or removed from one site—that’s a super admin task. This creates cleanup debt if you don’t audit regularly.

    The third trap: billing and domain mapping. If you’re using a plugin like Mercator or a host-managed domain mapping tool, site admins often can’t change the primary domain, even if they “own” the site contractually. That permission usually requires super admin access or a custom capability you’ve explicitly granted.

    How to audit and delegate access correctly

    Start by listing every user with super admin privileges. In the network admin dashboard, go to Users → Super Admins. If you see names you don’t recognise, or former contractors still listed, remove them immediately. Super admin is an all-or-nothing role; there’s no way to grant partial network control without a custom plugin.

    For site-level access, go to each site’s dashboard and review Users → All Users. Confirm that client administrators are scoped to their site only. If someone needs plugin installation rights but shouldn’t control the whole network, you have three options:

    • Pre-install and network-activate the plugins they need, then let them configure settings as a site admin
    • Use a plugin like Multisite Plugin Manager or User Role Editor to grant granular capabilities—like install_plugins—to site admins on a per-site basis
    • Promote them to super admin temporarily, have them complete the task, then demote them (risky, not recommended for clients)

    Most operators choose option one. It’s cleaner and avoids the support overhead of explaining why a client can activate a plugin but not delete it from the network.

    One non-obvious behaviour: user registration on multisite

    If you enable open registration at the network level (Network Admin → Settings → Allow new registrations), users who sign up are added to the network, not automatically to any specific site. They exist in the user table but have no role and no dashboard access until a site admin or super admin assigns them to a site.

    This confuses operators who expect self-service membership sites. A user registers, receives a confirmation email, logs in, and sees a blank dashboard with no menu items. They’re authenticated but not authorised anywhere. You have to assign them to a site and give them a role—Subscriber, Contributor, whatever fits—before they see content or functionality.

    If you’re running a paid community or course platform on multisite, automate this with a membership plugin that handles role assignment on purchase. Don’t rely on WordPress’s default registration flow.

    Multisite user roles aren’t complicated once you internalise the two-tier structure. But if you’re migrating from single-site WordPress or onboarding a client who expects full control, set expectations early. “Administrator” means something different here, and assuming otherwise costs you support time you don’t have.

    One Two Three Send publishes operator-focused breakdowns like this one every day. Subscribe to catch the next deep dive on the tools and infrastructure that actually matter.

  • Google Analytics 4 custom event parameters: the 25-limit nobody explains

    Google Analytics 4 custom event parameters: the 25-limit nobody explains

    Google Analytics 4 custom event parameters: the 25-limit nobody explains
    Photo: Ajiro Shinpei via Wikimedia Commons (CC BY-SA 4.0)

    Google Analytics 4 gives you almost unlimited flexibility to track custom events. You can fire anything: lead_form_submit, coupon_applied, video_watched. But there’s a hard constraint most solo operators don’t discover until it’s too late: GA4 only indexes 25 custom event parameters per property.

    After that, new parameters still get logged in the raw event stream—but they won’t appear in standard reports, Explore, or Looker Studio. You can’t dimension or filter by them. They’re effectively invisible unless you’re pulling BigQuery exports, which most small operators aren’t.

    This isn’t a bug. It’s a design decision Google made to keep the product performant. But it catches people by surprise because GA4’s interface doesn’t warn you when you’re approaching the limit, and old Universal Analytics didn’t have this restriction in the same way.

    How the 25-parameter limit actually works

    When you send a custom event to GA4—say, newsletter_signup with parameters like source, landing_page, referrer, and email_domain—those parameters need to be manually registered as custom dimensions in the GA4 admin panel before they show up in reports.

    GA4 gives you:

    • 25 custom dimensions (event-scoped)
    • 25 custom dimensions (user-scoped)
    • 50 custom metrics (numeric values)

    Event-scoped dimensions are what most operators burn through first. These are things like button_label, video_title, product_category—anything that describes a single interaction.

    Once you hit 25 event-scoped dimensions, you’re done. You can’t add more without archiving an existing one. And archiving doesn’t free up the slot—it just stops collection. Historical data stays, but the dimension becomes read-only.

    What breaks when you hit the ceiling

    Let’s say you’re tracking newsletter signups across six different lead magnets. You’ve been sending lead_magnet_name as a parameter for months. Then you launch a new sponsored post tracking setup and add five more parameters: sponsor_name, placement_type, cta_variant, reader_segment, and content_topic.

    You go to GA4 Explore to build a report. The new parameters don’t show up in the dimension picker. You check the raw event in DebugView—it’s firing correctly. The data is being sent. But it’s not indexed, so it’s not queryable.

    Here’s what you lose:

    • You can’t segment audiences by that parameter
    • You can’t build Explore reports around it
    • You can’t use it in Looker Studio dashboards
    • You can’t create conversion funnels that filter by it

    The only workaround is BigQuery, which requires a GA4 360 subscription (starting at $50,000/year) or a manual export setup most indie operators won’t bother with.

    How to plan your parameter budget

    The fix isn’t technical—it’s editorial. You need to treat custom dimensions like a finite resource and plan what you track before you start sending events.

    Start by auditing what you’re already using. Go to Admin > Data display > Custom definitions in GA4. You’ll see a list of every registered dimension and metric. Count them. If you’re above 20, you’re in the danger zone.

    Then ask: Which of these dimensions do I actually query? Most operators register parameters “just in case” and never look at them again. Archive anything you haven’t used in a report in the last 90 days.

    For new tracking, consolidate where you can. Instead of separate parameters for lead_magnet_name, lead_magnet_category, and lead_magnet_format, use a single lead_magnet_id and map it to a lookup table in your reporting layer. Instead of tracking button_color, button_size, and button_position separately, combine them into one button_variant string like blue_large_sidebar.

    This isn’t elegant, but it works. And it keeps you under the limit.

    The non-obvious tip: namespace your parameters early

    If you’re starting fresh or still have slots available, prefix your custom parameters by category. Use form_name, form_step, form_source instead of generic names like name, step, source. It makes your dimension list easier to scan, reduces the chance of accidental overwrites, and helps you spot redundant tracking before you register a new dimension.

    And when you do hit the limit? Don’t panic and start archiving things randomly. Export your current Explore reports first, note which dimensions they depend on, and only archive parameters that aren’t load-bearing.

    Want more breakdowns like this? Reply with the analytics edge case that’s been tripping you up—we’ll cover it in a future issue.

  • Affiliate link management: when spreadsheets cost you money

    Affiliate link management: when spreadsheets cost you money

    Affiliate link management: when spreadsheets cost you money
    Photo by Gorilla ROI Data Connector on Unsplash

    If you run affiliate links across your content—newsletter, blog, social—you probably started with a spreadsheet. Product name, affiliate URL, commission rate, maybe a notes column. It works until it doesn’t.

    The breaking point isn’t volume. It’s versioning. Affiliate programs change their URLs, update terms, expire cookies faster, or shut down entirely. Your spreadsheet doesn’t tell you when a link dies. You find out three months later when a reader replies asking why your checkout link 404s.

    What breaks first

    Spreadsheets fail at three things: link rot detection, historical performance, and propagation speed.

    Link rot is silent. An affiliate program migrates to a new domain, updates their tracking parameter structure, or sunsets a product SKU. Your old link still resolves—it just doesn’t credit you. Unless you’re manually testing every link monthly, you won’t know.

    Historical performance matters when you’re deciding what to promote next quarter. A spreadsheet can log clicks if you’re using a link shortener with analytics, but matching clicks to actual conversions requires stitching together your shortener dashboard, the affiliate network backend, and your own notes. Most operators give up and optimize for vanity metrics instead.

    Propagation speed is the operational bottleneck. You update a link in your spreadsheet, then you have to manually find and replace it across every past article, email archive page, and pinned social post. If the link appears in 40 places, you’re burning an hour. If you skip the older posts, you’re leaving dead links live.

    When a link manager pays for itself

    Dedicated affiliate link management tools—Pretty Links, ThirstyAffiliates, Lasso—charge $10 to $30/month. The ROI threshold is straightforward: if one broken link costs you more than one month’s subscription in lost commissions, the tool pays for itself.

    For a solo operator earning $500/month in affiliate revenue, a single high-value conversion is worth $50 to $200 depending on the program. One missed sale covers six months of tooling.

    The feature that matters most isn’t the link cloaking or the pretty dashboard. It’s automatic redirect updating. You edit the destination URL once in the tool’s backend; every instance of that short link across your entire site updates instantly. No find-and-replace. No archaeology through old posts.

    Link health monitoring is the second-order benefit. Tools like Lasso ping your affiliate URLs weekly and flag 404s or redirects that don’t resolve to the expected domain. You get an alert, fix it, move on. The alternative is discovering the problem when a reader emails you or when you notice commission drops in your next payout statement.

    The spreadsheet-plus-shortener hybrid

    If you’re not ready to pay monthly, the middle path is a spreadsheet plus a custom domain short link service. Rebrandly’s free tier gives you 500 branded links and click tracking. You store the short link in your spreadsheet, paste that short link everywhere, and update the destination URL in Rebrandly when the affiliate program changes.

    This works if you have fewer than 50 active affiliate relationships and you’re disciplined about logging every new link. It breaks when you forget to add a link to the sheet, or when you need to bulk-edit links by category (“update all Amazon links to the new Associate ID”).

    The hidden cost is context switching. Every time you create a new affiliate link, you’re opening three tabs: the affiliate dashboard to generate the URL, Rebrandly to shorten it, and your spreadsheet to log it. That’s 90 seconds per link. If you’re adding 10 links a week, that’s 15 minutes weekly—13 hours a year—on administrative overhead.

    What to do Monday

    Audit your last 90 days of affiliate links. Open your spreadsheet, click every URL, and verify it resolves to the correct product page with your tracking parameter intact. If more than 10% are broken or redirect incorrectly, you have a link rot problem worth solving.

    If you’re earning less than $200/month in affiliate revenue, stay with the spreadsheet but set a calendar reminder to re-check links quarterly. If you’re above $500/month or managing more than 30 active programs, trial a link manager for one month and measure time saved on link updates.

    The goal isn’t perfect tracking. It’s reducing the lag between when a link breaks and when you notice. Every day a broken link stays live is a day you’re sending traffic you can’t monetize.

    One Two Three Send covers the tools and tactics solo operators actually use to run content businesses. Subscribe to get one focused article daily—no filler, no fluff.

  • Canva’s Magic Resize: when aspect-ratio automation saves time vs. breaks it

    Canva’s Magic Resize: when aspect-ratio automation saves time vs. breaks it

    Canva's Magic Resize: when aspect-ratio automation saves time vs. breaks it
    Photo: Bystronic Corporate Communications via Wikimedia Commons (CC BY-SA 4.0)

    Canva’s Magic Resize feature promises to turn one social graphic into ten platform-ready versions with a single click. You design once at 1080×1080, hit resize, select Instagram Story + LinkedIn post + Pinterest pin, and the tool redistributes text boxes, images, and spacing to fit each canvas.

    It works exactly as advertised—when your design is simple. Two text blocks, a centered logo, and a background gradient? Magic Resize handles it cleanly. But stack five text layers with custom positioning, overlay transparent PNGs, or use grouped elements with manual kerning, and you’ll spend more time fixing the output than you would rebuilding from scratch.

    How Magic Resize decides what moves

    Magic Resize uses a hierarchy system. Canva prioritizes foreground elements (text boxes, stickers, uploaded images) over background layers. When you switch from a 1:1 square to a 9:16 Story canvas, the tool expands the vertical space and redistributes elements top-to-bottom based on their original layering order.

    Text boxes resize proportionally by default—font size stays fixed, but line breaks reflow to fit the new width. Images scale to maintain aspect ratio. Background fills stretch to cover the entire canvas without cropping.

    The problem: Canva doesn’t understand visual hierarchy the way you do. If your Instagram square placed a call-to-action at the bottom because that’s where the eye naturally lands in that format, Magic Resize will keep it at the bottom of a tall Story canvas—where it’s offscreen until someone swipes up.

    Grouped elements break the logic entirely. If you’ve grouped a text box with a shape to create a custom badge, Magic Resize treats the group as a single object and scales it proportionally. A badge that was 15% of your square design becomes 15% of your Story height—often way too large or positioned awkwardly.

    When to use it vs. when to duplicate manually

    Magic Resize works best for templated content where layout consistency matters more than pixel-perfect positioning. Weekly quote graphics, announcement cards, course promotional images—anything with one dominant message and minimal layering.

    Skip it when:

    • Your design uses more than four text layers with custom positioning
    • You’ve applied manual spacing or alignment that depends on the original canvas shape
    • Grouped elements make up more than 30% of the design
    • You’re resizing from a horizontal format (16:9 YouTube thumbnail) to vertical (Pinterest pin)—the text reflow often breaks readability

    For complex designs, duplicate the original file instead. Canva lets you copy an entire design and manually adjust the canvas dimensions. You’ll spend three minutes repositioning elements yourself, but you’ll have full control over what moves and what scales.

    The non-obvious tip: pre-size your text boxes

    Most operators let Canva auto-size text boxes—you type, the box expands to fit, and you drag it into place. That approach breaks Magic Resize because the tool doesn’t know which dimension (width or height) you prioritized.

    Instead, manually set text box dimensions before you type. Click the text box, drag it to a fixed width (say, 800 pixels on a 1080-wide canvas), then type your headline. Lock the width in place. When Magic Resize redistributes the layout, it preserves your width ratio and reflows text vertically—keeping line breaks predictable.

    Same goes for images. If you upload a logo or product shot, resize and position it first, then lock the layer. Magic Resize respects locked elements and works around them, giving you anchor points that stay consistent across formats.

    Pricing and access

    Magic Resize is available on Canva Pro ($15/month for solo users, $30/month for up to five team members) and Canva for Teams plans. The free tier doesn’t include it—you’ll need to manually duplicate and resize instead.

    If you’re publishing to three or more platforms weekly and your designs stay simple (under five layers, minimal grouping), the feature pays for itself in saved time. If your graphics are layout-heavy or require tight control over spacing and alignment, the Pro subscription still has value for the template library and Brand Kit features, but Magic Resize won’t be the reason you renew.

    Want more tool breakdowns like this? Subscribe to One Two Three Send and get operator-focused features, comparisons, and how-tos every week—no fluff, just the details that matter when you’re running a content business solo.

  • WordPress transactional email: when wp_mail() fails silently

    WordPress transactional email: when wp_mail() fails silently

    WordPress transactional email: when wp_mail() fails silently
    Photo by Mariia Shalabaieva on Unsplash

    WordPress sends password resets, comment notifications, and form submissions through a single PHP function: wp_mail(). It works—until it doesn’t. And when it breaks, you usually won’t know.

    There’s no delivery confirmation, no bounce handling, no retry logic. The function returns true if it handed the message to your server’s mail transport. What happens after that is invisible.

    For solo operators running contact forms, membership sites, or order confirmations, silent email failure costs conversions and creates support overhead. Here’s when the built-in system breaks, what to replace it with, and how to make the switch without touching every plugin individually.

    When wp_mail() actually breaks

    WordPress uses your server’s local mail transfer agent by default—usually Sendmail or Postfix. Shared hosting providers throttle or block outbound SMTP to prevent spam. Budget VPS instances often ship with no MTA configured at all.

    Even when mail leaves your server, deliverability suffers. Your domain lacks proper SPF and DKIM records for server-originated mail. Gmail and Outlook route it to spam or reject it outright. You’ll never see the bounce.

    Common failure scenarios:

    • Password reset emails never arrive, users assume the form is broken
    • WooCommerce order confirmations vanish, customers contact support
    • Gravity Forms or Contact Form 7 submissions disappear after the success message
    • Comment reply notifications stop working, engagement drops

    The function still returns true. WordPress has no idea delivery failed.

    Replace wp_mail() with an SMTP plugin or API bridge

    You need to route WordPress mail through a transactional email service with proper authentication and delivery tracking. Two approaches work:

    SMTP plugins reconfigure wp_mail() to connect to an external mail server. WP Mail SMTP (free) and Post SMTP (free) both support Gmail, SendGrid, Mailgun, and Amazon SES. You add credentials, test a message, and every plugin that calls wp_mail() automatically routes through the new transport.

    Setup takes ten minutes. The catch: SMTP connections can time out under load, and you’re still managing API keys in the WordPress admin.

    API-based plugins replace the SMTP handshake with HTTP calls. Postmark’s official plugin (free) and Mailgun’s plugin both inject an API bridge. Delivery is faster, retries are automatic, and you get real bounce logs in the service dashboard.

    For solo operators sending under 1,000 transactional emails per month, Postmark’s free tier covers password resets and form notifications. Once you cross 1,000 sends, pricing starts at $10/month for 10,000 emails—still cheaper than the support time spent debugging silent failures.

    One non-obvious configuration detail

    After you install an SMTP or API plugin, set a dedicated “From” address and verify it with your email service. Most plugins default to [email protected], which triggers spam filters if that address doesn’t exist or lacks DNS records.

    Create [email protected] or [email protected] as a real mailbox (or alias), add it to your transactional service’s verified sender list, and configure the plugin to use it. This single step fixes 80% of residual deliverability problems after switching away from wp_mail().

    Also: enable logging in the plugin settings. WP Mail SMTP and Post SMTP both include email logs that show exactly what fired, when, and to whom. When a customer says they didn’t get a receipt, you’ll know whether it was sent.

    When to stay with wp_mail()

    If you’re running a single-author blog with comments disabled and no forms, the built-in function is fine. You’re only sending password resets to yourself, and you’ll notice if those break.

    But the moment you add a contact form, membership plugin, e-commerce checkout, or any user-triggered email, the risk shifts. Silent failure becomes a business problem, not a technical curiosity.

    Switching to a transactional service doesn’t require a developer. Install a plugin, add an API key, send a test. If the test arrives and your logs confirm it, you’re done.

    What’s breaking on your WordPress site right now? Hit reply and tell us which email mystery you’ve been ignoring. We’ll cover it in a future piece.

Powered by CookieAdmin