Methods to hide email addresses from page source

Flash! If you have access to PHP, you can create a form in Flash and send the email address also from Flash to the PHP script. Otherwise, take a Flash button that contains the mailto: order to open the email client.

Personally I use a form and so do a lot of websites I've visited. Although it's nice to send an email in your client, or via your webmail, it's becoming a necessity to use a form to stop spam. And after a while it's no different or more of a hassle. Maybe less than a hassle in fact as you don't have to open a new window/message to send. It's all contained on the current page you're viewing.

If you must present an email address, make sure you've sent up spam filters on your inbox! I would suggest using a contact form aswell as an email address, so the option is there to use either. How you present the email address then would be up to you. I would see if there is a combination of the CSS unicode-bidi and Javascript, so it works when clicked or copied.

What do you think of this method:

HTML source standard: E-Mail

source encrypted with UniCode: Hyperlink Text

How smart are these grabbers to interpret this? (Online tool for unicode-encryption can be found here, in German: http://www.lerneniminternet.de/htm/tip_spam-email.html

guenter, this is the same method as described in method iii. spammers can easily replace unicode characters with "real" characters.

concerning "vii. Images" and accessibility: it should be enough to only show the "@" as an image - with, of course, an not to obvious name for this image...

Cool Cleveland, a weekly online newsletter in Ohio publishes email addresses thus: nameATdomain.com

This is straight text, not a clickable Mailto function. I suppose user agents can be trained to look for this variation.

i linked this site on my blog, because i wrote a similar tutorial some days ago that is not as good as this one here. thanks for your good job ;)

Another option is to link to a .php-script that spitts out random e-mail adresses. This would probably trigger some kind of protection on harvesters and get your site "banned"... could work :) Nice article, it's good to have everything on one place.

I once read that all these complex methods, trying to hide from spambots, are mostly not needed. a simple obfuscation like mathias.rem0veth1s@gmail.com (my addres) should fool most bots. The reason was that the bots doesn't need to be very clever considering all "open" addresses out there. It doesn't pay off.

Comments?

Using REMOVEthis in username portion of email is lame - as all email validators can validate domain name and this will be valuable information for them.

It's much better to use REMOVE this-like portion in domain name. like User@online.mydomain.com

Hmm... My favorite is the Image solution

Don't forget to link to some of the better form software out there. I have used this on on my site and it works great: http://ostermiller.org/contactform/

Another suggestion: HEX encoding.

ASCII: me@mydomain.dom

Hex: Email me

Here is an example of a perl script that will convert ASCII addresses to hex:

#! /usr/bin/perl
# Little perl program to convert ascii email addresses to hex
# to avoid spam harvesting from mailto: tags
my $addr = shift or die "usage: $0 email\@address.dom\n";
$addr =~ s/(.)/ sprintf('%%%2x',ord($1)) /ge;
chomp($addr);
print "$addr\n";

As documented at: http://publib-b.boulder.ibm.com/Redbooks.nsf/RedbookAbstracts/sg246930.html?OpenDocument

Chapter 2, preventing unwanted SPAM.

The issue as I see it is to try to confuse the bots while not confusing the humans.

On Saturday my blog received over 1000 spam comments, so I decided to do something about it and whipped up some "whitelist" functionality.

Email addresses are essentially pseudo-random strings of characters. I do not show email addresses with comments, but each comment has an associated email address. Each comment has an approved (boolean) field. Each comment has a verified (unique) field.

When you post a comment, I check to see if there is a previous *approved* comment with that email address. If there is, your comment is immediately & automatically approved to the live site.

If there are no previous approved comments using that email address, you are sent an email asking you to click a link to verify you're an actual human, and not just a bot. When you click that link, it passes the unique verify code & commentId via the GET querystring, and you essentially approve your own comment, thus adding yourself to the whitelist. BUT upon this verification I have the site notify me that someone has verified for the first time. In that email I am shown their comment, and given the option to delete it and remove them from the whitelist to prevent future automatically approved comments.

If they used a fake email address, they never get the verification email, and their comment is never seen.

Finally, I do send copies of all verified & approved comments to myself, so I don't have to surf my old entries to find them.

It's working great so far.

If you have any questions, feel free to email me at my first name, via my email-domain, geekunity.com

Anyone ever try the enkoder form from automatic labs? Search for enkoder on your fav se. Not sure how it ranks but seems pretty sweet.

Thanks for a great overview.

Off-topic: Avoiding spam is good and well but I've become a lot more casual about it since my ISP implemented the most diabolically elegant and effective anti-spam measure on their mail server. Simply put, they ignore all first smtp connect attempts from unkown ip addresses, and accept the connection if attempted a second time. It relies on the fact that most spam bulk-mailers use a fire-and-forget approach, i.e. ignoring all errors and moving on to the next address (of millions). My spam fell from dozens per day ... to 1 or 2 a month. More info here: http://www.pair.com/support/knowledge_base/e-mail/junk_e-mail_filtering_overview.html#4

How about an equally comprehensive overview of spam control mechanisms and their true effectiveness?

Great overview, but like the last comment having a good anti-spam email service is recommended.

I recommend TUFFMAIL (http://www.tuffmail.com). I get a secure (encrypted transport) service, along with a very effective anti-spam policy which has cut spam out of my life for good (1-3 every couple months).

Check it out.

I've been using the enkoder. It produces a rather large javascript to scramble the mailto, but what appears on the screen is a plain email address. It displays a line that says "Javascript must be enabled" if java is turned off or not present. So far, so good. Creating the encryption is VERY easy!

I have used a JavaScript solution with great success. Basically:

[a href="http://domain.com/contact/"]contact me[/a]

It's a little more complicated than that but that's the essence of it. The href takes you to a contact form if your browser can't execute the onclick function.

Sometimes I concatenate the email string in a script: writeemail(prefix,suffix,domain...) and provide an alternate method in noscript tags: contact[at]domain[dot]com

Using an image is also great if you also want to reduce the numbers of emails sent. People is to lazy to type in the adress themselves. They rather just copy/paste or click. And the emails you still get is the important ones.

I'm a fan of using the forms partly because then your reader doesn't even need to load up an email app (though this could be seen as inconsequential).

I've used CGI scripts to hide addresses while still giving visitors the ability to click on a link and open their mail program. The links look like this:

email me (http://www.foo.bar/cgi-bin/email.cgi)

and the CGI script looks like this

#!/usr/bin/perl
print v76.111.99.97.116.105.111.110.58.32;
print v109.97.105.108.116.111.58;
print v110.97.109.101.64;
print v112.108.97.99.101.46.99.111.109.10.10;

where I've used Perl's v-string notation to obscure the address even in the script (which I suspect is overkill). The script prints out

Location: mailto:name@place.com

with two newlines at the end. This directs the browser to the mailto: link, which in turn opens whatever mail client the browser is configured to use.

I am using encryption in a way that leaves a pseudo address, so the spam harvester wastes their resources on non-existent addresses. I do this by not encrypting the '@' or the '.com' or other top-level domain.

If javascript is not enabled then the image method works well, note that PHP is great for dynamically creating images from text if you need to do so.

I noticed that you don't have an example of a true encryption scheme (using keys and what not). This script:

http://www.jracademy.com/~jtucek/email/download.php

has you pick prime number keys, then RSA 10-bit encrypts your email address.

Crack that, spambots!

My favorite solution is one not described here using normal html comments: foo<!-- >@. -->@<!-- >@. -->bar<!-- >@. -->.<!-- >@. -->baz

When displayed on screen it will look like this: foo@bar.baz

The comments in the html obscure the formation of the address and I've found that putting the special symbols @, ., and > inside of the comment will make parsing the comment out more difficult.

The CSS text-reverse trick is stylish but also breaks accessibility guidelines. To be confident the email address is accessible to everyone, you would need to avoid images (except with meaningful alt tags), Javascript and dependence on a stylesheet to make sense. Accessibility guidelines would also rule out most simple CAPCHAs because they depend on vision or hearing to work. Although spam is a big problem, we shouldn't allow it to drive us to excluding people using assistive devices. Properly marked-up forms might be the most inclusive way forward.

TAG:

Calling someone's suggestion lame is unnecessarily inflammatory and doesn't encourage discussion.

Consider that getting lists of domain names is easier than web harvesting, so obscuring domains in one's web publishing is quite lacking in effectiveness. Not long after I register new domains I start getting spam to guessed accounts. Fekkers didn't get those addresses via web harvests.

If you're talking about domains more technically, meaning subdomains, you could try to keep those obscure since they're not published like registered domains. But I didn't read that as your point.

The REMOVETHIS methods are sadly burdensome. The whole having to cope with harvesters thing is sadly burdensome. The whole spam thing is sadly burdensome. Keep in mind that greed hurts everyone.

Many thanks to Sarven Capadisli for offering this well-detailed and described summary.

I prefer and recommend the php form method for my clients (method xiv).

Besides keeping the spam bots away, I think it has many other benefits: - professional looking - it doesn't require an email app (great for the MANY web email people) - can help guide visitors in how to communicate with you (when including other form elements for options/interests)

Thanks also for the reminders about accessibility problems using "images" (method ix).

I just put this on the last line of my page: "Trying to find my email address? Well, you know my first name, and my domain name... I'm sure you can figure it out. ;)"

What do you think of this?

Best way I've found is changing the email address to ascii (even the mailto: bit) and not putting your email addy on screen. So the text reads "click here to contact us" and the mailto: link doesnt look like a mail link until its parsed by the browser.

I use this on a very busy site, and only get a couple of spam mails a week (probably human input).

I use one of the text to ascii sites out there. Simple and quick.

I think you should've mentioned the mixture of javascript and written styles: you put in the text written, then transform the pseudo-adresses into real adresses with mailto: links

I'm surprised the article didn't mention khansen's (above) HEX technique. I've used it to great success.

Why go through all this when you can just write your email like this

foo[at]bar.baz

replacing @ with [at} and no link.

I love what Derek Marin wrote! Great idea!

I like the method at this link. It's a PHP script that outputs a javascript script which uses the eval() command to interpret some escaped (javascript unicode?) characters. The resulting HTML is quite cryptic.

Why bother at all?

First of all: Every technique used might hurt customers, since there is no guarantee that they can use the mailto: link afterwards without problems.

Second: Spamfilters are quite good now. So deal with it on your side, not on your customers side.

I like Derek's method for handling comment spam, that's similar to what I do besides the authentication email. Mostly I've found that my method only really allows manual entries of spam, and then with the email I recieve I can delete that comment with a couple clicks.

And that spam blocking boesman mentioned is pretty nifty.

Form is probably the most effective, accessible method.

I've used the enkoder and it worked fine so far. But what I usually use on my site is a javascript function. Instead of giving the bot all the information in one place. I pass some basic info to the function which assembles everything when clicked.

Perhaps I should extend this to "normallly" use the function, but without javascript a click would load up a form to send an email...

Thanks for the article. :)

I use this hex encocder which encodes the entire html code for the mailto tag. Never had any spam problems.

http://automaticlabs.com/products/enkoderform

I've used this free 'service' which provides a few solutions. http://w2.syronex.com/jmr/safemailto/

I use the encoded-@ method and it works beautifully. Here's why: Spamming is a bulk market. If my bot spends twice as long looking for those few @-encoded addresses or other variants, I'll get less addresses overall. And that hurts my business. Frankly, there are so many completely unhidden email addresses out there, they may never need to rewrite their bots. All they'd catch for their trouble is a couple of savvier web users, who are in fact less likely to respond to the spam anyway.

Some of these are very creative. But personally, I don't think it matters how you try to scramble the address, if it's interpretable, it can be scrapped programmatically. In fact, these are now available to anyone who wants to write the program to beat any of these methods.

Bottom line. Use a form. Yes it has drawbacks of possibly not getting the user's correct reply address. However, they offer security from spam, feedback, a minimum of standardized input to make it easier for you to recognize where the email originated from and more.

I think the automated labs enkoder is really a superb e-mail enkoder!

Only you can easily comment *what a large JS is produced here*

But you can put in a enkoder.js and just put the functionName(); in script tags where the e-mail needs to appear in the HTML

Wow!, that's great, I wrote about this article in my blog :)

I use this http://www.jracademy.com/~jtucek/email/

It's amazing.

How many bots are still in use ? is it not just as easy for spammers to assume E-Mail address's exist ie fred{at}domain.com

spammer can see bar.baz as a domain so just adds fred, mary, ringo, foo etc at the begining. I use spamcop.net and after 10,000+ spams have had maybe 10 or so that should not have been filterd. I think the ability of anyone to create E-Mail address's is what needs changing. Just like we need to apply for a phone number we should have a system for handing out E-Mail address that stay with you for life regardless of your IP host. accountability would be a step forward.

I get tons of spam, but none to the address I have on my website. All I do is, I give the address as text [not linkable]. I've been doing this for years, with not one piece of spam yet (to that address). Is this not a simpler method than those described in Sarven's excellent article?

Nice page. If you take a look at my website (page http://trashy.sourceforge.net/faq.php#howtocontactauthor ) you will see another interesting way I found to show an email address using only an html table. (I'm referring to the 1st one displayed.)

bye. yayo

If you have enough budget, go for an e-Mail Forwarding service that has a capability of filtering those SPAM harversters. Create a FORM that sends all requests/feedbacks to that address. They shall get forwarded to your MailBox. Don't forget to get a good ISP that filters SPAMS too. So you get double filterings. Or else, combine HTML+CSS+JavaScript+[Server Side Scripting]. They're all available on this article. No thing is a "Perfect-10". If no CSS, you got JavaScript and/or Server Side Scripting and vice-versa.

Fake email + timed Javascript. Without JS (or if the browser fails), the user gets a real mailto: link but to user@example.REMOVE_ME.com. Upon page load, the script waits several ms then alters the href to point to the real address. this method without timer, slightly altered method with timer ("e-mail" link) and source.

On my page I use the simple rot13 javascript encryption from http://scott.yang.id.au/2003/06/obfuscate-email-address-with-javascript-rot13/

and it seems really good. But I wasn't happy that people eithout javascript couldn't read it at all. Like those with screen readers or lynx.

So here's my solution: have the

[script] elements around the javascript code.

Rot13.write('rot13d email address with mailto');

Then put [noscript] elements around a link free readable obfuscation like: mail to: foobar At this domain

This makes it so that if javascript is enabled, you only see a working link, but if it's not, you get enough info to figure it out.

This seems to me like a good way to do it because it complies well enough to w3m and is transparent for people with modern browsers.

For the [noscript] bit, use the most bloated human-readable email hider in the world to generate a random-text logo of the email address, which uses inline CSS to shrink it down to resemble normal text. This will still be visible even with javascript and images turned off.

You can combine the encoding method and the JavaScript method for a mask that's virtually unbreakable:

function email() {
 if (!document.getElementsByTagName) return;
 var anchors = document.getElementsByTagName("a");
 for (var i = 0; i < anchors.length; i++) {
       var anchor = anchors[i];
        if (anchor.getAttribute("href") &amp;&amp;
            anchor.getAttribute("rel") == "email") {
            anchor.href = "mail" + "to:" + 
                   "%79%6F%75%" + "%40" + 
                     "72%65%6D%61%69%6C";
        }
   }
}

Add this function to an external JavaScript file, include it with your HTML document, and put in the body tag. Now write all your contact links like this: <a href="contact.html" rel="email">. If the user has JavaScript, they will see a mailto: link. If they don't, they will see a link to your contact page. This is XHTML-compliant.

Thought you might like to know that I referenced you here: http://diagrammes-modernes.blogspot.com/2006/05/obscuring-your-email-from-spammers.html

Thanks for your work! If I'd read it in time, I might not have done my article.

Though a laudable effort i fear this is all a little pointless. This has probably been mentioned but if you are using your own domain in a business context. The spammers will just throw random commonly used prefixes at it anyway. eg. if my site were www.spannermonkeys.com then any spammer worth his salt will try sales@spannermonkeys.com support@spannermonkeys.com

etc even to the point of harvesting common names from the about us section of the site and using them as prefixes too. Think i have depressed myself now, boo.

Well I I've been using a js script to obfuscate my email for years and they work! Personally I think that the really complex ones that encrypt your email aren't all that useful since even the simple ones require a human to figure out the logic behind them and anytime ia human is involved all they need to do is click the link to see what email pops up in the email client.

Anyway, I created my own, free email cloaking script for folks to check out.

BTW, I often seperate my email addresses by a dot, eg: my.name@mydomain.com. The extra dot also throws off the spam trollers and makes it harder for the auto-generators to guess your prefix.

I use my little obfuscate php. works nice so far, but not bulletproof: http://lightwavers.net/mail.php

Something I have found is to enter the mailto link at tinyurl.com. Then, I simply link to the tiny URL, which redirects to the email address. Works great, and is SO easy.

Nice site with nice ideas

This is a method that fixes the inaccessibility problems of:

p span.displaynone { display:none; }

foo@barnull.baz

Nice article, thanks a lot!

Another method to display your email-address without harvesters being able to recognize it is CSSfont: http://www.cssplay.co.uk/menu/cssfont.html

I like Tobias TinyURL Solution. Are there any disadvantages? Isn't it supposable likely that email-spiders follow all the links in a page with the goal to find new addresses at the target pages? If that was so they would grab the "tinyurled" email address, isn't it?

Another tactic is using .htaccess to password-protect the webpage containing the e-mail address.

How this works: Your website has a page to the e-mail address. You tell your visitors that when they enter the page, they have to type a password. Once they typed the correct password, they can see your e-mail.

How many automatic e-mail harvestors would be smart against that?

I usethe form (with no email address) quite a bit, as in most of my situations a customer benefits greatly from being directed by the right questions, as opposed to an open, free-for-all email.

However, I do make sure to send them a copy of the email when they submit it, with a reply-to address.

This opened the possibility of harvesters being able to collect my reply-to address so I added an extra, hidden field into the form that must be left blank for the email to be considered legitimate. Most harvesters that fillout form automatically will fill in every field.

Seems to work well.

Hello, which e-mail address is "relevant" for spam bots? Is it the link (mailto:xy@example.com) or the text - or both?

Forms seem popular, however aren't there similar problems with those - trying to find accessible captchas?

I think a good approach is to offer the user both form- and link-based contact options. There are good security advantages to forms, but when I'm the user, I like to have my message in my Sent box and to actually know the address I'm sending to.

Is there any script in the frontpage form format that i can use to stop hackster who have harvested our e-mails? We get so much spam. Does this in anyway effect real mail we should be recieving?

Great article, I found this site that obscures you email address using CATCHA. http://www.emailcover.com

How about using form technology as follows?:

<form>
   <input/>
 <input/>
</form>

The cgi script returns a page with the e-mail address plain as day. Perhaps spambots aren't daring enough to submit forms. This is exceedingly old technology (no Javascript, php, etc.) and should be accessible to darn near everyone.

A long long time ago, when I started using the internet, spam didn't exist. I decided to buy my own domain name. Then I got spam, but it was too late to hide. My address is everywhere, and I would have to change it, with all the trouble that would cause me. So I'm keeping it, and I don't mind putting it in clear everywhere. I have a spam *fighting* system doing a very good job.

Ah, I also leave randomly-generated addresses in the source code of my pages, to collect spam for my spam fighting system :)

It is working pretty well!

Interesting idea is changing a part of email address every year, and put it in a code normally as plain text.

For example for this year: 2007foo@bar.baz

About CSS unicode-bidi; it is funny, because when you mark and copy email address you get revers text. Exactly like in the code :- )

One other possibility is to use a short term address which changes regularly, i.e. june07@mydomain.com and simply reply to all legitimate contacts telling them to use your real address in future. Then you delete the e-mail forward in July.

Note: my Opera 9.23 doesn't handle mailto redirects :( And it doesn't display the content, I send after the redirect header. (For example an anchor tag with the email address.) So I need to watch the USER AGENT string...

Here is a technique I ran into recently

http://www.explainth.at/en/tricks/cheatmail.shtml

I put here (An accessible email cloaking technique) a script that mix two techniques you described.

I notice that you didn't list the mod_rewrite solution. I found this the other day and it blew my mind - http://www.spamshiv.com/solutions/mod-rewrite.php. This solution using Apache's mod_rewrite to write out mailto link like a plain URL. It's totally awesome.

Here's a little diddy I put together:

<script>
    function protect(name, address, display){
        var link = name + "@" + address
        if(!display) { display = link; }
        document.write("<a href='mailto:" + link + "'>" + display + "</a>");
    }
</script>

Then, in the body copy, use this script in lue of a "mailto" call:

<script>protect("evan", "waetzman", "email me");</script>

This writes the code in the DOM & the front end user can't see a difference (looks like a regular email link). The spiders don't see anything. The 3rd line in the script makes the "display" optional. If you don't put something in there, it'll default to the email address. This has been cross browser/cross platform tested.

Hope this helps -

Evan

Evan, I like your method but the end of the email address (.com, .org, etc.) seems to be missing from your code? Though it can be easily added I think. I suppose you could also add a subject line "tag" as well.

Also, there's no need to designate what type of script is being used, like javascript?

Best, David

If your using php you can use the Ming library => http://ca3.php.net/ming to create flash. I belive that php5 here comes with it packaged in => http://www.entropy.ch/software/macosx/php/. You could create a simple button and text to create the mailto link. They have a simple example at the bottom of that page at the php.net site link above.

Great article, thanks! ...just a word of caution: The HTTP Redirect method does not work in Safari 3, because it won't parse a Location header that contains ":"

Instead, you'll get the following error in safari:

Safari can’t open the page “http://www.yoursite.com/emailto.php” because it cannot redirect to locations starting with “http:”.

Look at the source code of this page below. A multi-pronged approach that would appear truly bullet-proof to bots:

http://itelegram.com/telegram/contact.asp

Look at the source code, and notice the results of a cut and paste on the email address.

There's also a gotcha with the Hex encoding method.

Google converts the hex back to the original text when it indexes your site, so the naked email address will appear in both the google listing for your page, and the google cache of your page.

thanks for all the hints and tricks... great to have all in one spoot, much appreciated!

me and my friends have been using 3 diffrent scripts apart from a contact form with "captcha" with great result...

my personaly favorite is "Email Protector" linked over to contact form for those who dont have javascript enabled...

Email Protector by Jim (RSA encryption 10 bit) http://www.jracademy.com/~jtucek/email/download.php

The Enkoder by Dan http://hivelogic.com/enkoder/form

Email Address Munger - Email Address Encoder http://www.addressmunger.com/ http://www.addressmunger.com/contact_form_generator/

// Sweden

Hi there,

I didn't know there're so many ways to protect email addresse on the web.

http://www.fincy.com/spameater

However, using the javascript version above, I've written a prog that converts the email address into ascii-code.

For better protection the email address and the ascii-letters in a letter-array are also splitted and mixed up with some randoms.

This might sound complicated, but it's not since there's a form available that generates all encrypted htm(l)-files, pictures of your email address and an external javascript file automatically.

All you have to do is to choose the picture style and throw your page into the program.

After encrypting you'll receive the encoded files to download. So that's also for ppl who are not so qualified in programming.

Hope it will help someone.

Cheers Tümmel

I think that once your website is visible enough to spammers, they will just spam you at info@, mail@, etcetera. Hiding the emailaddress is mostly about hiding the domain name, and they already know the domain-> they're visiting it.

IDEA -> use a form where people fill in their email adress to get your address. An automatically generated email could be sent to them. Another automatic email could be sent to you. That way you know who has your email address. This might be slightly user unfriendly but can be good for some situations.

IDEA -> Use a catch-all email address to receive email. Use the viewer's IP address for the email address that they are given on your website. i.e. 127.0.0.1@website.com This could be useful to keep track of who is emailing you. When the email is real, you give them your genuine address. When the email is spam, you have their IP. This is probably not completely spam-proof, but maybe there are other ways to use email addresses based on user-info, to track who is emailing you and get info about the spammer.

UNSPAM -> An initative of unspam.com to forbid compliant robots from harvesting email addresses. Usage: <meta> Replace the [link to your terms] with a link to your terms of use page. Alternatively you may include a link to www.unspam.com/noemailcollection

I don't know how well the unspam idea really works, but I like it and it might scare off some parties.

Yeah, I've investigated most of these methods.

The Flash methods seems worthy, but much to my horror, I recently found one of my Flash embedded-text on Google! Google had actually disassembled the swf and put the legible stuff online. If they can do it, so can a malevolent spam-spider.

Temporary measure: One way, perhaps, is to put the email-id in pieces in a text file, and have the swf load it and re-assemble it at object-time. This is what I am developing now. ANYTHING to avoid capchas! ;-) But I'm sure eventually a nasty email-harvester would figure their way thru this. If they haven't already...

Thanx fer some great ideas.. too bad I already thought of most of them.. ;-)

Anyone like to comment on this one?

http://www.jottings.com/obfuscator.htm

All the "spammers" have to do is read a few webpages like this one and come up with numerous ways with simple perl scripts to find real mailto tags or addresses with html comments or just plain text with @ changed to "at" or "[at]".

how can anyone trust some other site to not sell the email adresses?

php scripts etc seem complicated for casual bloggers etc...

I think an image with no mailto link is about the only way that seems reasonable from what I've read here.

Something not mentioned here is that document.write() function of javascript does not work with XML or XHTML (served as application/xhtml+xml). There used to be a hosted cgi script that worked pretty good, but I don't remember what happened to the host (and the source was never disclosed for the obvious reasons).

That really is the best thing. Come up with your own solution and DO NOT tell anyone what it is! Then the likely hood of it being negated by spam bots is GREATLY reduced!

Thanks for huge list of hints, however, I think those who are afraid readers of their pages are too lazy to read their address coded in form of an image and write it into mail client need to invest to a good spam filter and use a script-based "encryption" (if they can survive customers without script allowed will not read it).

For those who expect e-mails from people who consciously decided to write having a good reason for that, for those (including me) showing address in form of an image without "mailto:" ref is not a problem.

At the same time it is definitely problem for bots.

What about this one?

http://www.maurits.vdschee.nl/php_hide_email/

I really like this study - it was extremely informative. I would have liked to see more data about email addresses in the form of images. I’ve just developed a new technique to have Apache webserver automatically convert all email addresses in HTML source into images in the output stream. It is all seemless and on-the-fly, and all without touching the source format in any way. I’ve written a proof-of-concept /w example on my blog.

Here is another tool to encrypt your email address.

http://www.securedhostingonly.com/knowledge/protect_your_email_address.php

It goes along EXACTLY what examples are being given here.

I like this website since it's a mere fill-copy-paste to my protected email address on my web page.

Regards

Marc

Hi, I am using http://www.mobilefish.com/services/hideemail/hideemail.php to protect my email address against spam bots. This site also contains other useful tools.

I think the best way is to output your email adress as usual, along with a few fake ones that is hidden from human visitors (i.e only visible in the source code). Add zxy0spam@yoursite.com and qwerty.asdf@yoursite.com and automatically flag any mail to any of these two adresses as fake. Then, when you are checking your email, the software needs to check these two accounts first to harvest spam, and then download emails from your real adress - excluding the ones that previously has been marked as spam.

The only problem might be to find this kind of software :D

The question I ask myself is, why would spammers waste resources trying to decrypt even the most basic of these methods? The kind of people who would go to the small trouble of even the most basic methods are surely smart enough to not open any spam let alone buy something or pay anyone money.

Is there some solution for encrypting emails in flash? Some actionscript encrypter? Approach for flash movies mentioned in this article is quite inefficient! Google is able to grab any text data containing in swf incl emails. So don't be surprised about seeing your email adress on google... And spam bots use google to obtain email-adresses!! Please let me know if you know any solution for that problem.

Hello!

I'm using my own template class which has a function to split the e-mail into smaller strings, then joins them back using HTML comments between them.

The dummy address test.address@some.email.server.net would look like this:

<!-- >@. -->test.<!-- >@. -->address<!-- @. -->@<!--detolsaeimdmatesveerstsernres.>@. -->some.<!-- >@. -->email.<!-- >@. -->server.<!-- >@. -->net<!-- >@. -->

It also generates an anchor HTML element:

<a href="">onclick="window.location='ma'+'il'+'to:' + this.innerHTML.replace(/<!(?:--[\s\S]*?--\s*)?>\s*/g, ''); return false;">the obfuscated e-mail address</a>

This also enables the user's email client. I wonder if the bots are smart enough to extract the ReX from the JavaScript replace function in order to get the correct email address.

The only problem is that once your email is out there it's out there. Plus some directory's list your email address.

If you combine two or more of the suggestions in this article then you should minimise your email spreading further.

We have used @ for @ and a redirect php.

I have checked and most of all the big firms do not try any of these methods. I think the reason is they want people to contact them and they are prepared to deal with the spam as all businesses have too deal with the problem at some level.

Either that or the alpha geek is over paid.

I'm using the reCAPTCHA mailhide http://mailhide.recaptcha.net/

Why not combine a couple? How about having an image that people can read as an email address, couple with a javascript that pieces together the email address?

I found another cleverly way in www.firmasec.com website,

explode from "@" and "." for 3 or 4 piece.

replace "@" to "@picture"

replace texts with php "strrev" function

display replaced texts with css+xhtml unicode-bidi:bidi-override;direction:rtl;

also few times i see a null spans and images between exploded texts and image