User-permissions confirmation email - Security bot opens the confirmation link before the user

You could do two things:

  1. Detect if the clicker is a bot. Either via IP or with the user-agent.

  2. Detect how the link is clicked (e.g. how fast, or add an invisible link)

This blog could help: How can you avoid robot clicks in your emailing statistics?