Plain Text Email

Why It Matters

• Spam bots harvest plain text addresses constantly. Automated scrapers scan millions of web pages looking for the @ symbol followed by a domain name. A plain text email address on your site will be found — usually within days of being published.
• Spam wastes time and degrades productivity. Once your address hits spam lists, the volume of junk email can be overwhelming. Sorting through it wastes time and increases the risk of missing legitimate messages buried in the noise.
• It can introduce security risks. Spam emails frequently contain phishing attempts, malware attachments, and social engineering attacks. The more spam an inbox receives, the higher the chance that someone will eventually click something dangerous.
• It affects your domain reputation. If your email addresses end up on spam lists, your domain may get flagged by email filtering services. This can cause legitimate emails you send to land in other people's spam folders.

How to Protect Email Addresses

1. Use a contact form instead. A form lets visitors reach you without ever exposing an email address in the page source. This is the most effective approach because there is simply no address for bots to find.
2. Encode the address with HTML entities. Convert characters in the email address to their HTML entity equivalents. This makes the address harder for simple bots to parse while still rendering correctly for human visitors.
3. Use JavaScript to assemble the address. Build the email address dynamically with JavaScript so it never appears as a complete string in the HTML source. Bots that do not execute JavaScript will not see it.
4. Display the address as an image. Rendering the email address as an image prevents text-based scrapers from reading it. However, this approach is not accessible to screen readers, so pair it with an alternative contact method.
5. Use CSS direction tricks. Display the email address with reversed text direction using CSS and correct it visually. The source code shows the address backwards, confusing simple scrapers while looking normal to visitors.

Common Mistakes

• Thinking "nobody will find it." Even an email address buried deep in a subpage will be found by scrapers. Bots index the entire web, including obscure pages that get very little human traffic.
• Using mailto: links with plain addresses. A mailto: link makes the email address just as easy for bots to harvest as plain text. If you use mailto links, apply the same obfuscation techniques to the address within them.
• Only protecting some addresses. Obfuscating your main contact email but leaving employee addresses in plain text on a team page still exposes your domain to spam lists. Protect every address on your site consistently.
• Sacrificing accessibility for protection. Image-based email addresses are invisible to screen readers. Always provide an alternative way to contact you — like a contact form — that works for everyone, regardless of how they browse.