What are some ways to protect emails on websites from spambots?

Question

I'm creating a public internet facing website which contains the email address of their salespeople.

What kind of programming options do I have to generate the "mailto" and display the email from that address but limit the spambots from picking up the address?

Lawrence Dol · Answer 1 · 2015-08-11T15:07:44.130

10

Recaptcha has an excellent capture based email protection. You can see it implemented at the bottom of any page in my website using the Site Feedback link.

edited Aug 11 '15 at 15:07

answered Jan 10 '09 at 05:48

Lawrence Dol

63,018
25
139
189

Unfortunately, with the ne version of reCAPTCHA this feature does not exist anymore. – lorenzli Aug 07 '15 at 05:59
@lorenzli: Yes it does, I just changed my site email a couple of weeks ago using it. Now at tech.dolhub.com. – Lawrence Dol Aug 08 '15 at 17:55
@LawrenceDol https://google.com/recaptcha/mailhide/ gives a 404 error, subdirectories such as /admin/ are redirected to the new site without the mailhide feature. – lorenzli Aug 10 '15 at 23:10
1

@Lorenzli I found the mailhide page with a simple search. Added the link to my answer. – Lawrence Dol Aug 11 '15 at 15:09
As of 2022 - Mailhide, the service provided by Google that relies on reCAPTCHA - no longer exists and hasn't for some time. The only Mailhide services is a third-party service, and I'm personally skeptical about since the copyright footer on their website hasn't been updated in 2018. A small thing, maybe, but if they can't get such a small thing right, I'm skeptical they can do such a complex thing as email obfuscation on the modern web. – Hashim Aziz Jun 09 '22 at 00:11

score 7 · Answer 2 · answered Nov 21 '08 at 13:38

7

I know that Facebook does it by displaying an image instead of text. Sure, they could use OCR on the image, but why bother for just one email address?

If you really didn't want spam bots to get an email address, the best way is to never show it to anyone. Show a link to "Contact this person" which brings up a form. On the server side, send the contents of that form to the recipient, with a reply-to of the sender's email address. Include a little blurb at the bottom of their message that "if this email is spam, please 'click here' to block this user", which will then block the IP of the sender. I've used this method on a number of occasions and have never had a single complaint.

answered Nov 21 '08 at 13:38

nickf

537,072
198
649
721

What happens if the sender mistypes their email address? – danmine Nov 23 '08 at 12:43
too bad, i guess. If your users have accounts, you could prefill the sender's name and email address. – nickf Nov 23 '08 at 23:45
6

I'm less likely to fill out a form than I'm to write an e-mail. – Georg Schölly Sep 10 '10 at 08:45
The method you mentioned in the second paragraph is great but sometimes those emails are filtered and sent to the spam folder automatically. In those cases, there is a risk that the recipient never see the message. – pablofiumara Sep 17 '13 at 09:59

score 4 · Answer 3 · answered Nov 21 '08 at 13:48

4

You can obfuscate it but IMHO whatever you do, one day spammers will get your email address. The future is in spam filters, not trying to keep email addresses secret.

answered Nov 21 '08 at 13:48

mmiika

9,970
5
28
34

1

Yet the harder you work to obfuscate it initially, cutting out the problem at the root, the less hard you will have to work at cutting out spam for the lifetime of your website. – Hashim Aziz Dec 28 '21 at 20:06

score 3 · Answer 4 · answered Nov 21 '08 at 16:01

3

What I have done in the past is use javascript to build the mailto: link. This is nice for the users because they can just click on the link and I don't know of any spambots that take the time to execute javascript yet.

I think I got the idea from Jakob Nielsen's useit.com website.

In the page header I have this piece of javascript:

<script name="mailto" language="JavaScript">
    //<![CDATA[

    function load()
    {
        c1 = "bcl"
        c2 = "brian"
        c3 = "lane"
        c4 = "com"
        // Fill in the addresses
        document.getElementById("contact1").innerHTML = "<a href=" + "mail" + "to:" + c1 + "@" + c2 + c3 + "." + c4 + ">" + c1 + "@" + c2 + c3 + "." + c4 + "</a>";
    }
    //]]>

</script>

Tell it to load it when the page loads:

<body onload="load()">

And then in the body of the page I put a link to a spamtrap:

<span id="contact1"><a href="mailto:spam@brianlane.com">spam@brianlane.com</a></span>

answered Nov 21 '08 at 16:01

Brian C. Lane

4,073
1
24
23

1

That may work against the simple bots, but a spider that understands enough Javascript (or parses the generated source code) can easily collect the e-mail addresses. – Raymond Martineau Nov 21 '08 at 17:01
for XHTML compliance so you can use < and & – nickf Dec 19 '08 at 11:12
Do you think this method has an effect on indexing of the website. Is it maybe important that Google should index the email address, or is that not important. – Saif Bechan Dec 13 '11 at 15:21
@SaifBechan If you're trying to avoid spam, then you absolutely do not want Google or any other search engines indexing your email address. – Hashim Aziz Jun 09 '22 at 00:14

vsync · Answer 5 · 2019-07-02T07:37:55.857

I have a solution, well, more of a theory. Problem is, the bots parse the page. they can get the text. even if it's being put into the page in some sophisticated way through Javascript.

So, just you CSS3 pseudo element! it won't be a link, but your email will be visible, and will never be an actual text. something like this:

.email::after{ content:'myemail@gmail.com'; }

Again, it's a theory, I've no idea how far these evil people can go to get it, but I think this be pretty safe.

Update (JULY 19')

I now in the opinion this isn't a problem since email servers have become good at filtering spam and there's no reason to make any elaborate tricks to "protect" email text on webpages.

score 1 · Answer 6 · edited Oct 27 '11 at 14:43

1

Have a look at PrivateDaddy - I think it does exactly what you're looking for: fully automatic, unobtrusive email cloaking that even works with browsers where JavaScript support is disabled. You can get it here (free of course)

edited Oct 27 '11 at 14:43

Bill the Lizard

398,270
210
566
880

answered Dec 24 '09 at 16:23

Dan

19
1

I work on a community web site with many (10K+) email addrs in user generated content - was going to implement a server side parsing code + image generation to do the trick - ended up implementing it with Privatedaddy and left the data intact. – Jan 12 '10 at 17:12
Maybe I'm missing something, but not only does PrivateDaddy obfuscation appear to leave the text unobfuscated (which may be a benefit for some), but the [example](https://www.privatedaddy.com/example) it gives does not seem to be obfuscating anything at all. I followed its advice and checked the page's source, and it showed the full email address both in `mailto:` and text form. – Hashim Aziz Dec 28 '21 at 20:03

score 1 · Answer 7 · answered Nov 21 '08 at 13:46

If this is not a static HTML page, but a ASP.NET, JSP, Coldfusion, or PHP page then you could have a drop down box with a list of all your sales people, a text box for comments, and a "Contact Us" (ie, Submit button). When the button is clicked, it will call a server-side code which creates the email and sends it to your local mail server for delivery. The outside world will never know the email address of your sales people, nor the email format (ie, firstname.lastname@yourcompany.com) of your company.

score 0 · Answer 8 · answered Nov 21 '08 at 13:38

0

You can use something like email obfuscation

answered Nov 21 '08 at 13:38

GregD

6,860
5
34
61

2

I can be wrong, but I believe that nowadays it is inefficient. I doubt spammer's crawlers are unable to decode entities, since the trick is well known now. – PhiLho Nov 21 '08 at 15:31

score 0 · Answer 9 · answered Nov 21 '08 at 13:40

This is a difficult problem. If you post an e-mail such that it can be parsed by a web browser so that it's clickable, then it can be parsed by a spambot. If it's not clickable (e.g. if it's an image), it's more difficult for users. On one side is perfect, seamless experience for users and on the other side is perfect spam-blocking. A simple CSS or javascript to take in an email address as separate tokens is usually better than nothing, though.

score 0 · Answer 10 · answered Nov 21 '08 at 13:44

0

You could only show a part of the e-mail address "us...@mail.com" as a link that redirects to a captcha, then display the full e-mail address like Google Groups does.

answered Nov 21 '08 at 13:44

schnaader

49,103
10
104
136

1

That's the reCaptcha solution above. – Geremia Dec 16 '15 at 17:43

score 0 · Answer 11 · answered Nov 21 '08 at 13:44

0

We used to do classic ASP string cat for email addresses, the grand idea being that spambots read source, but don't parse server-side code. I have NO idea if that actually works.

answered Nov 21 '08 at 13:44

John Dunagan

1,445
3
18
30

? If you look at the source and see the plain e-mail, it won't work! – PhiLho Nov 21 '08 at 15:34

score 0 · Answer 12 · answered Jan 10 '09 at 06:27

Would something that I wrote work for you?

http://kevin-le.appspot.com/viewSource/sourceShare/asmRevealer.js

...and you could see the demo here:

http://kevin-le.appspot.com/extra/contact

It works with mailto, so it's convenient for users, but spambots won't be able to pick up which is your requirements. It'll be obvious once you spend 1 minute looking at the demo.

score 0 · Answer 13 · edited Jun 09 '22 at 00:07

I got the same problem too and i came up with a quick but effective method to help my website out.

Basically bots just read the content of the web page but in 99.999% they do not trigger events, it would require a great amount of dedication and work, things hacker don't usually do in favor of bigger numbers and quicker effects.

So i came up with this function:

function emptyMail() {
    let mail = document.querySelector('#your_mail');
    let mailValue = mail.href;

    mail.href = "";

    mail.addEventListener('mouseover', function() {
      mail.href= mailValue;
    })
}

This worked for me i hope it can help you too.

score -2 · Answer 14 · answered Nov 21 '08 at 15:42

I see the mailto: protocol almost dead anyway... It is convenient, but too easy to parse and gather.

Plus it has its downsides: if you are on a Web cafe, it won't work because it will call whatever default e-mail client it has (if it has any!) and it is not set up on your account. Same if you use exclusively online e-mail managers...

A possible workaround is to decorate e-mails, relying on users to type or correct them: foo (at) example.com or foo-NOSPAM@REMOVE-THIS-example.com are common schemes (hoping spammers doesn't try to decipher these common schemes!), graphical e-mail addresses are another way.

Or, as pointed out, if you can, the best option is to have a contact form, with some reasonable form of protection against robots, that would be usable from everywhere. Although people might be defiant on forms asking for e-mails (for response!), so a disclaimer might be useful too... :-)

If you see a mailto: link, most browsers allow you to copy the link location or the e-mail address. Some browsers may also be configured to support webmail, even if you need a plugin or extension. — Raymond Martineau, Nov 21 '08 at 17:05
mailto isn't dead! email is the core of internet, how could people talk to each other without it? it's so basic. you click a link, then write whatever to that person. how can it be easier? — vsync, Apr 24 '13 at 19:48

What are some ways to protect emails on websites from spambots?

14 Answers14

Update (JULY 19')

Linked

Related