Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

What's a good way to list a "Contact Us" email address on a web site, while reducing the likelihood it will get spammed?

Is putting the email address in an image the best technique, or are there others?

share|improve this question
34  
Be aware that anything that beats a bot will also probably beat a visually impaired user –  MrChrister Jul 8 '10 at 20:47
    
+1 good question –  Evan Plaice Jul 8 '10 at 23:17
1  
    
@MrChrister ...and white on white beats the user but not the bot. –  Talvi Watia Sep 17 '10 at 7:34
2  
Turns out... somebody setup a honey pot and collected results over a longer time length. Here are the results... superuser.com/questions/235937/…. Apparently, using CSS to change the direction of the address and/or inserting arbitrary hidden code into an email address are the best solutions. Apparently, OCR isn't a commonly item in the spambot toolbox. –  Evan Plaice Jan 21 '11 at 23:29
show 1 more comment

26 Answers 26

I pass all contact forms through a throwaway Gmail account, that forwards mail to the real email address. It's free, it's easy, and Gmail's spam detection is top notch.

It requires no extra effort when making the website, and if anything gets through you just login to the Gmail account and flag it as spam.

You can then set the Gmail inbox to either automatically archive anything that has been forwarded, or even delete it if you don't want that extra copy kept there.

share|improve this answer
2  
Great technique! –  vmarquez Jul 9 '10 at 19:18
2  
I have a Google Apps account which I use in a similar manner. The advantage of Google Apps over a Gmail account is that you can create up to 50 email aliases (nicknames) per account. I used to use Gmail accounts for stuff like this, but I would always forget the login info 1 year later and it was more of a pain that with Google Apps. (Still a great technique. +1) –  jessegavin Jul 12 '10 at 14:59
    
+1 but I can see a downside - some people would trust an email from your own domain, rather than one setup using a free email provider. –  Lazlow Jul 13 '10 at 20:53
5  
Lazlow: I should've been more clear. I had that issue at first, so I currently setup a mail redirect using the site's domain, that redirects to a Gmail account, that forwards to my personal email address (which is another Gmail account), which tags it with a label defining which site it came from and skips the inbox. People think they're emailing info@mydomain.com or contact@myotherdomain.com but they all come to my primary Gmail account and sit in labels for mydomain, myotherdomain, etc. –  Callan Jul 14 '10 at 15:48
1  
Gmail also allows you to response with email address that you have verified. So you could respond from within gmail as "roy@royronalds.com", though the actual email would specify a subtle difference like "sent on the behalf of roy@royronalds.com by roy@gmail.com". Few are even likely to notice that you're using gmail to actually send as if from another address. –  Kzqai Jul 16 '10 at 17:38
show 1 more comment

Use an email obfuscator

share|improve this answer
12  
Comparison of techniques with 1.5 years of data techblog.tilllate.com/2008/07/20/… –  Doug Harris Aug 3 '10 at 19:34
add comment

My non-answer is to not do this. Modern email systems, such as GMail and the Barracuda anti-spam appliance, do an excellent job of filtering spam. Any barrier that you put between you and your visitors means a lower level of engagement and, depending on the type of site, potential loss of sales.

If you are worried about users who don't have native mail client installed, or who don't have the mailto: handler set correctly, then have a Contact Us page with BOTH the linked email address and a form (without a CAPTCHA) and let the user choose.

Spam is annoying, but it's our burden to bear, not our users.

share|improve this answer
add comment

Use natural language to spell out the eMail address...

Ex:

thatguy at gmail dot com

You'd be surprised how much harder it is to write a bot that can differentiate natural language vs writing a bot that just searches for the @ sign and regexes a normal address.

It isn't 100% foolproof but it isn't any worse than obfuscation and it won't alienate your visually impaired users and/or users that have JavaScript disabled.

Update: Here's an example of this technique in action.

Update 2:

It turns out that someone has actually done research on this and posted it online. See the SuperUser post describing the results or the original article

share|improve this answer
    
+1 for simplicity and effectiveness –  seanl Jul 9 '10 at 8:48
4  
I tend to question this approach. Mainly because it has been around for a quite long time and I can't imagine any email crawler developed during the last 10 years that would not start each new page by replacing "at", "[at]", "dot" or similar with their respective characters. –  phq Jul 9 '10 at 10:27
    
@phq Why? Is it so hard to believe that there aren't crawlers that can defeat all of the JavaScript and encoding obfuscation options by taking a snapshot of a page, running OCR, and regex for @? Just because it is possible to create a bot that can workaround all of these techniques doesn't mean that spammers will. The advantage of using natural language is it's use is a lot more diverse than a standard email URI. The @ symbol usually doesn't. –  Evan Plaice Jul 9 '10 at 21:38
2  
@Evan, my point is that this technique has become too common which usually is a problem when fighting spam. I claim that this technique is not a natural language technique, that would be something like "Email me at the domain example with the tld com and the username foo". The "at" technique is only a symbol replacement technique. –  phq Jul 10 '10 at 13:13
1  
I've also seen thatguy funny-symbol gmail.com –  rlb.usa Jul 15 '10 at 19:11
show 5 more comments

Personally, I don't display email addresses on sites, but instead have an easy to use, accessible contact us form, along with an indication of who the email is from; allowing users to send the site owners and operators emails, without exposing email addresses or having to jump through various JavaScript hoops, etc.

This is often the best way to go if your spam filtering isn't that sophisticated.

share|improve this answer
2  
There are lots of spammers now that fill out such contact forms. –  txwikinger Jul 9 '10 at 18:57
4  
I never fill contact forms. If I can not find a contact eMail then I simply do not do business with that company. Now, if it is a must for me and there is no contact eMail, I prefer to call by phone, even internationally. The problem with contact forms is I can never be sure if they will forward a copy of the typed information to my eMail address so, I am obligued to copy-paste the information to somewhere to keep track of the details. –  vmarquez Jul 9 '10 at 19:22
    
@vmarquez: Fair enough. Would you be happy if there was an option to forward the mail to your address too? I've got a number of clients who want to enable their users to email them in a way that works in an accessible, non JS enabled way, without exposing their email addresses to spammers. They do have their phone numbers on their sites, so you would be able to contact them that way; Out of curiosity, do you record your phone calls with companies to keep track of them as well (seeing as most claim to record them for training)? –  Zhaph - Ben Duguid Jul 9 '10 at 19:59
2  
@Zhap: You are right, I am happy if the page with the form have a note indicating that I will get a copy of my request by eMail. Some Sites include that note and I use the form. For the cases where I need to call by phone I do not do my request during the call. I ask for an eMail instead and proceed to eMail them. I prefer the initial contacts to be made by eMail because I tend to make product/services research in behalf of many clients and that way I keep a detailed trail of what was asked/answered in each case. –  vmarquez Jul 10 '10 at 9:23
    
@vmarquez: Good to know, thanks :) –  Zhaph - Ben Duguid Jul 10 '10 at 12:43
show 2 more comments

use css to hide some noise from the real text (just all in one line, i formatted it to better illustrate the technique):

u<span class="spam">noise</span>ser
@<span class="spam">noise</span>
example<span class="spam">noise</span>
.com

and then use this little css-snippet:

.spam { display: none; }

if you need valid mailto: content, then you have to create it via jscript in the dom, see some of the other answers for that. but i am not a big friend of that.

share|improve this answer
    
does this work for selecting the text? –  Andrei Rinea Jul 9 '10 at 20:21
2  
This isn't accessible though, since screenreaders tend to ignore stylesheets. –  DisgruntledGoat Jul 12 '10 at 15:53
add comment

What I do is write out the email address as words, wrapped in a span tag: <span class="email">joe dot blow at gmail dot com</span>. Then a page-level script runs, grabbing any such spans and replacing each with a constructed email link. It may not be too obscure, but I've had no complaints. Plus if JavaScript is disabled, the user can still read the actual span text.

share|improve this answer
1  
Nice idea - and accessible too –  pelms Jul 9 '10 at 10:03
    
This won't be of much help against good bots. If the bot runs the JavaScript (which isn't a big thing to do - run the page in a browser engine and grab the generated HTML) it has a perfect address. Catching someone at gmail dot com is not a little bit harder than catching someone@gmail.com –  Mircea Chirea Jul 17 '10 at 6:26
add comment

The best solution: use a spam filter.

I actually use Gmail to handle my POP3 email account for my business, because it's much easier to check email on different computers. Gmail's spam filters are the best in the world.

So you can just display webmaster@example.com as your email address and forget about spam.

share|improve this answer
    
+1, Spam Assassin can also be tuned to be extremely effective for those who don't want to use Google. –  Tim Post Jul 28 '10 at 19:06
add comment

using html encoding like &#649&#7854&#7575, the browser will render it like "abc"

share|improve this answer
1  
I've used this technique before and it seems to work well. It's also transparent for users and doesn't rely on JavaScript :) –  Michael Mior Jul 15 '10 at 19:16
    
It would be a royal pain to write a bot to parse that text. On the other hand it's pretty obvious it's an e-mail address or something sensitive. –  Mircea Chirea Jul 17 '10 at 6:30
    
Actually, it would be really easy to write a bot to parse HTML entities. Deciphering encoded text is something that computers do quite readily, but humans have a lot more trouble with (which is why your browser does it for you). Which is why it's sorta odd that this method is still effective. –  Lèse majesté Nov 1 '10 at 0:11
add comment

Use a graphic library (such as GD which is supported by PHP, or similar) to dynamically create .png images containing the email addresses.

Compared to my other answer this solution is less annoying for the users (but not transparent; they can't copy & paste it but must re-type it from scratch) but is also less secure: a computer can potentially read the unobfuscated image.

But overall I think it's a good compromise; it will stop the vast majority of spam bots.

share|improve this answer
    
It will also annoy the vast majority of users. No click, no copy-paste, gee, thanks, this is especially annoying on a small device like a phone, where you can't really type fast. –  Mircea Chirea Jul 17 '10 at 6:33
add comment

A quite good, while not perfect way is to create the e-mail address via javascript. Most spiders looking for e-mails do not execute javascript, and hence do not find a readable e-mail address.

Here is just one example how it could be done.

share|improve this answer
3  
what about users that don't have JavaScript enabled? –  Evan Plaice Jul 9 '10 at 8:56
1  
@Evan: Who, in this 21st century, disables JavaScript, except those rare sysadmins browsing the web from a production box? ;-) –  Chris W. Rea Jul 9 '10 at 22:26
1  
@Chris, I only turn Javascript (or cookies) on, if there's something specific I want from the site that requires it (like this site, for example). Of course, I may be the last of my kind... :) –  Cyclops Nov 28 '10 at 14:22
add comment

I use a simple Python script to convert the e-mail address into an mailto link where the e-mail address is HTML entity encoded. This is completely transparent to the user, but seems to obscure the contents enough to defeat most simpleminded harvesting bots.

#! /usr/bin/env python3.0

def entity_encode(text):
    out = ""
    ba = text.encode()
    for i in range(len(ba)):
        out = out + "&#x{0:02x};".format (ba[i])
    return out

def print_email_link(address) :
        print('<!-- {0} -->'.format(address))
        print('<a href="{0}{1}">{1}</a>'.format(entity_encode("mailto:"), entity_encode(address)))


print_email_link("test123@example.com")

This gives the output

<!-- test123@example.com -->
<a href="&#x6d;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#x74;&#x65;&#x73;&#x74;&#x31;&#x32;&#x33;&#x40;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x63;&#x6f;&#x6d;">&#x74;&#x65;&#x73;&#x74;&#x31;&#x32;&#x33;&#x40;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x63;&#x6f;&#x6d;</a>

When the result is pasted into a web page, the browser displays the text "test123@example.com" as a hyperline to "mailto:test123@example.com", so it is just as convenient to the end user as including the address in the clear. But it does seem to defeat many harvesting bots.

Obviously, I delete the comment with the plain ASCII version of the address once I've pasted the obscured e-mail link into the appropriate spot in web page's HTML source.

share|improve this answer
add comment

Ask the user to resolve a CAPTCHA before showing them the email address (or if you have a contact form, before letting the user submit it).

It's the most annoying for the users but definitely the most effective.

share|improve this answer
9  
I don't know which is more annoying, having to enter captcha or clicking an email link getting an outlook express setup wizard. It obviously depends on the audience but I think the contact form is the way to go. –  Gabriel Jul 8 '10 at 23:40
    
@Gabriel: I agree –  Andreas Bonini Jul 8 '10 at 23:45
    
@Gabriel: Captcha is definitely annoying but I completely agree with you. I wish people stopped using mailto. Easy enough nowadays sending e-mails directly through the server. –  Omar Kohl Jul 9 '10 at 7:58
1  
CAPTCHA is not a solution IMHO. Don't punish your users for other's sins. You are placing the burden on your users where there are other solutions. –  vmarquez Jul 9 '10 at 19:16
add comment

I'm a fan of obfuscation, where the email address is essentially rendered with Javascript.

For example, my@email.com could be rendered as

<a href="javascript:location='mailto:\u006d\u0079\u0040\u0065\u006d\u0061\u0069\u006c\u002e\u0063\u006f\u006d';void 0">
<script type="text/javascript">document.write('\u006d\u0079\u0040\u0065\u006d\u0061\u0069\u006c\u002e\u0063\u006f\u006d')</script></a>

As far as the user is concerned, it's normal text and can be copied and pasted. Bots on the other hand will have a harder time with it.

Here's the obfuscator I used.

share|improve this answer
    
You could also use <a href="#" onclick="document.location.href='mailto:...'; return false"> –  Mark Henderson Jul 8 '10 at 23:19
    
Those two solutions won't work too well without JS though, right? –  Grant Palin Jul 9 '10 at 6:35
add comment

One way:

  <script language="javascript"> 
  <!--
  var name = "user"
  var host1 = "gm"
  var host2 = "ail.com"
  var addr =
  document.write("<a href=mai" + "lto:" + 
    name + "&#64;" + host1 + host2 +
    ">" + name + "&#64;" + host1 + host2 + "</a>")
  //-->
 </script> 

You can write "Unscramble my email: user at com dot gmail" in <noscript> tags for those who have javascript turned off. This way you get the hyperlink functionality. You have a good chance at keeping spamers away from your address and people with javascript turned off or text only browsers can still get your email address.

share|improve this answer
    
I use the same, with multiple vars - as to me it would appear harder to piece together the individual values, for a bot. –  Lazlow Jul 13 '10 at 20:59
add comment

All the obfuscation techniques in the world can't help in the long run if you get a lot of people contacting you. All it takes is for someone to drop you a message and later get infected by some malware that scans their inbox / sent mail / address book /whatever for valid addresses, andyour address it out there being passed from list to list [I even have contacts who are stupid enough to put there email address and password into online forms for the most idiotic of reasons, you probably have too, the most recent one was a site that offered to compute someone's "email astrology chart and predictions" which immediately spammed all the fool's contacts with an invitation to the same site and <deity> only knows what other lists we are now on as a result].

The address on my public web-sites isn't just a throw-away address - it is on a throw-away sub-domain. If I start getting spam on that sub-domain I create a new one, update the sites where my contact details are listed, and a short time later I completely remove the sub-domain from DNS records. If you do this, or any other throw-away address techniques, make sure you make clear (on any page listing the address and in the footer of any mail you send using that address) that the address will change in future and if people can't get through they should check back to make sure they have the correct address.

This has the advantage of just being a simple address for people to click (if their browser+mailer are linked that way) or copy+paste without needing to use their brains to edit the address afterwards (I'm always surprised by how many otherwise intelligent and observant people can't get that sort of thing right). It also means my mail server doesn't spend its days bouncing messages sent to "random" addresses (aaron@, adam@, amy01@, ...) at the expired sub-domains. It also doesn't confuse screen-readers used by the blind or poorly sited.

Another option that I've not tried yet is to use an AJAX request to read in the email address and other details. This may be slightly more effective than document.write based obfuscation, though will add a little extra load on the web server.

I used to use "contact me/us" forms instead but I found that they get spammed as much as, sometimes more than, plain-text email addresses - sometimes by scripts that are trying to use the form to create an account somewhere rather than use it as a contact form.

share|improve this answer
add comment

If you have a bot filter (using 1x1px, subnet, known bots, jscript detection, http referrer and browser agent) you can simply not display the information if its a bot.

Solution in PHP:

<?
if (!isbot()) {
  echo 'mailto:'.$email_address_for_real_people;
  }
  else {
  echo 'mailto:yourself_bot@'.$bots_domain_address;
  }
?>
share|improve this answer
    
BTW, isbot() is a user-created function that points to whatever bot filter routine you have. –  Talvi Watia Sep 6 '10 at 22:05
add comment

The easiest thing I've found is to use a contact form where there is a default address, but also the ability for the user to select who the communication should go to (marketing, sales, tech support, etc.). Then, based on the value of the drop-down the posted form data is sent by the server to the appropriate email address.

Run this contact list out of a database table so you can easily update/add entries to the drop-down. That way you're never exposing any sort of address to the wide world of spam bots, and still give your users a great way to send in feedback.

share|improve this answer
add comment

I've used fred@no-spam.domain.com for years. Users typically know enough to delete the 'no-spam.'.

Otherwise, I just use a contact form with a 'captcha' and send the mail directly from the website.

share|improve this answer
4  
I'm surprised your users know enough to delete the 'no-spam'. Usually making asumptions about users being able to think a step ahead leads to quite disastrous results. It wouldn't occur to me to remove the no-spam unless you add some note instructing me to do so (and even in that case many people don't read notes, pop-ups ...). –  Omar Kohl Jul 9 '10 at 7:54
7  
How do you know your users know to remove 'no-spam'? You're only going to hear from the ones who do :¬) –  pelms Jul 9 '10 at 10:00
1  
@pelms: Good point, but some consider that an advantage. It can act as an intelligence filter screening your incoming mail... –  David Spillett Aug 6 '10 at 9:24
add comment

Here is another email obfuscator: Enkoder, from Dan Benjamin. It comes both as an online app and a standalone app for Mac.

share|improve this answer
add comment

One thing I do is use the API from http://www.stopforumspam.com to check for spammers. Feel free to contact me for details and I will be glad to help you with it!

Bud Manz

Manz Web Designs, LLC

share|improve this answer
add comment

If you don't mind using javascript, you can use something like ROT13 for obfuscating the email address. For example see this:
http://scott.yang.id.au/2003/06/obfuscate-email-address-with-javascript-rot13/

Personally, I prefer using a contact us form and not worry about the spambots, but of course it all depends on your requirements.

share|improve this answer
add comment

I use a PHP function to generate some javascript to output the the script at runtime. Note that you don't need PHP to generate the JS at runtime, you can generate the JS once locally and then include the static JS in your page.

You can also use the linked function with this snippet below to automatically obfuscate email addresses in given a given HTML (where $processedContent is the HTML):

 $emailMatches = array();
 $matchCount = preg_match_all('/(?:[a-zA-Z0-9_\.\-])+\@(?:(?:[a-zA-Z0-9\-])+\.)+(?:[a-zA-Z0-9]{2,4})+/', $processedContent, $emailMatches);

 if($matchCount > 0) {
    $emailMatches = $emailMatches[0];

    foreach($emailMatches as $email) {
    $replacement = createJSMailLink($email);

    $processedContent = str_replace($email, createJSMailLink($email), $processedContent);
 }
}
share|improve this answer
add comment

If you're using a contact form, you could do the fun technique of using random names for your inputs.

For example, I make a contact form, instead of using email as an input, I would use liame, same with name (eman), and comment (tnemmoc). The bots don't actually know what those inputs do, so they just disregard them.

share|improve this answer
add comment

I've set up a Google Docs Form / Spreadsheet. I can check form entries once a day and my inbox isn't flooded.

share|improve this answer
add comment

Use Zoho Creator to set up a contact form. The feedback you receive will be stored on a database that you can access online & it will also be emailed to you.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.