We built a website with all our team members and their email addresses displayed on our About page. Now the question arose if bots will be able get their email addresses and send spam using those.

What is the best way to prevent this in 2021? Is protecting email addresses using JavaScript obfuscation still valid in 2021?

  • 1
    Or you can convert them to images. This allows to humans to still use them. Oct 18, 2021 at 22:03
  • 1
    Why not use a form with a drop down to choose the team member? Hmmm...actually, I wonder if a simple drop-down that then exposes the email address would be effective.
    – Steve
    Oct 18, 2021 at 22:51
  • 1
    I think it depends on the level of obfuscation. If you use a common library, they might be clever enough to be able to deobfuscate that. There are a number of alternatives, like mentioned in the comments above. See this related question: Way to list "Contact Us" email address on web site, yet reduce likelihood of spam?
    – dan
    Oct 19, 2021 at 1:04
  • @rohit-gupta using images isn't actually all that friendly to visually impaired users, you'd need to put the address in the alt text of the image, and then you're back to having the email address in plain text... Oct 21, 2021 at 18:48

2 Answers 2


It is still somewhat effective. I have one page on my website that has my email address on it. That email address is unique to that page and I don't use it elsewhere. That page:

  • Uses JavaScript and HTML entity obfuscation for the email address
  • Doesn't use a mailto: link (you have to copy and paste the email address from text on the page)
  • Is disallowed by robots.txt
  • Isn't linked from my other pages (although it does have at least one external link after 15 years)

I still get zero spam at that address. How much of that can be attributed to the JS obfuscation compared to the other protection measures is impossible for me to know.

I would not recommend putting all your team members email addresses on your website with obfuscation. Even if bots can't read the emails, you don't want anybody to be able to copy all the email addresses by hand and email your entire office.

I'd recommend installing contact form software on your website that allows email to be sent to any of your team. I wrote a free, open-source, contact form that you can use. There are also good contact plugins for most content management system such as Contact Form 7 for WordPress or the Contact module for Drupal.


It depends on the bot. JavaScript certainly still makes a difference (I'd say the majority of bots don't parse JavaScript), but there are no doubt some bots that can parse it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.