Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

We seem to be getting A LOT of email spam, we have a combination of the email addresses as mailto links and contact forms that send to the same address.

What measures can we put in place that will eliminate the majority of spam?

We need to keep a visible email address and contact form so there's no way to just remove those.

share|improve this question

4 Answers 4

up vote 3 down vote accepted

a solution to that is to render the email information encoded, and a javascript function decode them and show them after the page have been load.

Nothing hard to code and deocode, a simple one can do the work.

Other way is to render your email to an image and show the image.

With any trick like that the spammers can not easy read your email to place it on a database and starts send you spam.

I found a page with many examples: http://csarven.ca/hiding-email-addresses

Now, for the contact form you must use a CAPTCHA,


or some other similar ideas. http://stackoverflow.com/questions/8472/practical-non-image-based-captcha-approaches/2544519

share|improve this answer
Can recommend the JavaScript method. I'm protecting all my email adresses with a tiny JavaScript, and never got spam to this adresses. –  martinstoeckli Jan 26 '12 at 12:28

Since you already had your emailaddress publicly available on the website it's already too late.

You can still remove the plain-text email address from the website. There are several techniques for this, e.g.:

  1. 'Ofuscate' the address: E.g. info at example dot com or inforemovethis@example.com
  2. Use an image which contains the emailaddress
  3. Remove the mailto: link and let the user just copy/paste the address

As others already have mentioned you should add some sort of a CAPTCHA to prevent bots from spamming you contactform.

IMHO It's impossible to prevent getting spam. Even if you wouldn't had you email address publicly available spammer will still try lots of emailaddresses on a certain domain. If the server sends back a NDR they would know the emailaddress isn't valid. I think the best thing you can do is install a spamfilter. You could either install one on the mail-server or if you don't have access to the server you can always install a spam-filter on the clientside. I use Spambayes myself on the client side and we also use server side filter. So most spam messages just don't reach the client or will be caught on the client side.

share|improve this answer
A spam filter is the way to go. Obscuring the e-mail address makes it harder for people to contact you and, depending on your target audience, may actively prevent people contacting you. –  ChrisF Jan 26 '12 at 12:30
@ChrisF - On the other side, the more spam you get, the bigger the risk that you filter out a good one. Publishing the email unprotected, guarantees to get a lot of spam. –  martinstoeckli Jan 26 '12 at 12:45
@martinstoeckli - good point there. OK - a combination of approaches is what you need ;) –  ChrisF Jan 26 '12 at 12:52

Have a look at Recaptcha: http://www.google.com/recaptcha

That will solve your contact form issue, for the visible email addresses do not display them in a clickable form (i.e. contactus (AT) mydomain (DOT) com).

share|improve this answer

As spambots generally fill in all fields of a form, I use a hidden input which, if filled in, prevents the form from being submitted.

Obviously you'll need to have a label associated with it (also hidden) which states that it should be left blank so that screen reader users know what it's for and don't fill it in.

I've been using this approach for years and it seems to work pretty well.

share|improve this answer
These are called honeypots. –  AbsoluteƵERØ Aug 13 '13 at 14:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.