Skip to content
INFIMA Knowledge Base

Add a custom header to your phishing tests

You’re driving phishing tests through our API, and you want each one to arrive with a custom header at the top of the message — your own banner, notice, or marker. The good news: there’s nothing to add to your API calls. The header lives on the client, not the request. Set it once, and it lands on every phishing test that client receives — the ones we send automatically and the ones you trigger through the API, exactly the same.

The External Email Header is a field where you paste your own HTML. Whatever you put there renders at the top of the phishing email, above the template content.

You’ll need

Section titled “You’ll need”
  • The HTML for your header.
  • The client’s ready-made Inky-style banner turned off — that banner and your custom header share the same spot at the top of the message, so only one can be active at a time. See Add an Inky-style caution banner.

Set the header

Section titled “Set the header”

  1. Open the client and go to its phishing settings — the same area where you set the phishing test interval and the Inky-style banner.

  2. Make sure the Inky-style banner is set to Off. If a banner size is selected, the custom header field is greyed out, since the two can’t both occupy the top of the message.

  3. Paste your HTML into the External Email Header field. There’s a formatting helper next to it that tidies your markup so it’s easier to read and edit.

  4. Save your changes.

You’ll know it worked when

Section titled “You’ll know it worked when”
  • The External Email Header field holds your HTML and isn’t greyed out.
  • The next phishing test to land for that client shows your header at the top of the message.
  • A test you trigger through the API shows the same header — you didn’t change anything about the call to get it.

Frequently asked

Section titled “Frequently asked”

Do I have to change my API calls to get the header? No. The header comes from the client’s setting, not from the send request, so your existing calls pick it up automatically. Any phishing test for that client carries it, no matter what kicked off the send.

Can I send a different header on different API calls? No — it’s one header per client, applied to every test that client gets. If you need different headers for different groups of people, set them on different clients rather than per call.

What can I put in the field? Any HTML — a styled banner, a short notice, an image. It’s dropped in at the top of the email body, so treat it like any other email content: inline styles and simple table layout travel best across mail clients.

Why is the field greyed out? The client has an Inky-style banner turned on, and that banner uses the same spot. Set the banner variant back to Off to hand-build your own header. The two are never active at once — turning the banner on clears a custom header you’d saved, and we warn you before it does.

Does setting a header change which tests go out, or when? No. It only changes what the email looks like — the top of the message. It doesn’t touch which templates we send or how often.

Does it affect the client’s real mail? No. It only appears on your phishing simulations for that client, never on their real email.

Section titled “Related”