Email Addresses on Web Pages: Keep Them Away from Spam Bots
Spammers run bots that crawl the web collecting anything that looks like an email address. An
address published as plain text or in a mailto: link is usually on spam lists within days, and it
stays there for years. It’s also a gift to phishers, who use real staff addresses and names to make
their messages more convincing.
Why it matters
- Spam volume. Harvested addresses get sold and reused indefinitely.
- Targeted phishing. A list of employee addresses tells attackers exactly whom to impersonate and whom to target.
- Privacy. Personal addresses of staff or customers published by accident (in a comment, a testimonial, an old PDF link) are personal data you’re exposing.
What we check
We look for email addresses in the page’s visible text and in mailto: links. Text inside scripts
and styles isn’t counted, and file names that only look like addresses (such as logo@2x.png) are
ignored.
| Result | When |
|---|---|
| Passed | no email addresses are visible |
| Needs attention | at least one address is visible |
The report shows up to five addresses, masked (for example j***@example.com), so the report itself
doesn’t publish them again.
How to fix
Use a contact form for general enquiries. Protect it with a CAPTCHA or a service like Cloudflare Turnstile, and send the messages to an address that never appears on the site.
If you must show an address, use a role address (hello@, support@, press@) rather than a
person’s, and give it strong spam filtering. Role addresses can be changed or retired without
affecting anyone’s personal inbox.
Obfuscation slows bots down but doesn’t stop them. Writing hello [at] example [dot] com,
splitting the address with HTML entities, or assembling it with JavaScript defeats simple
harvesters. Modern crawlers that run JavaScript see through the latter, so treat it as a speed bump.
Check old content. Blog comments, PDFs, staff pages and archived newsletters are common sources of forgotten personal addresses.
Some addresses are meant to be public
Certain addresses should be easy to find: a security@ address for vulnerability reports
(published in security.txt), or the contact details your local law requires
in a legal notice. That’s fine: give them good spam filtering and keep them role-based.