4

We built a website with all our team members and their email addresses displayed on our About page. Now the question arose if bots will be able get their email addresses and send spam using those.

What is the best way to prevent this in 2021? Is protecting email addresses using JavaScript obfuscation still valid in 2021?

Improve this question
4
  • 1
    Or you can convert them to images. This allows to humans to still use them.
    – Rohit Gupta
    Commented Oct 18, 2021 at 22:03
  • 1
    Why not use a form with a drop down to choose the team member? Hmmm...actually, I wonder if a simple drop-down that then exposes the email address would be effective.
    – Steve
    Commented Oct 18, 2021 at 22:51
  • 1
    I think it depends on the level of obfuscation. If you use a common library, they might be clever enough to be able to deobfuscate that. There are a number of alternatives, like mentioned in the comments above. See this related question: Way to list "Contact Us" email address on web site, yet reduce likelihood of spam?
    – dan ♦
    Commented Oct 19, 2021 at 1:04
  • @rohit-gupta using images isn't actually all that friendly to visually impaired users, you'd need to put the address in the alt text of the image, and then you're back to having the email address in plain text...
    – Zhaph - Ben Duguid
    Commented Oct 21, 2021 at 18:48

2 Answers 2

Reset to default
2

It is still somewhat effective. I have one page on my website that has my email address on it. That email address is unique to that page and I don't use it elsewhere. That page:

  • Uses JavaScript and HTML entity obfuscation for the email address
  • Doesn't use a mailto: link (you have to copy and paste the email address from text on the page)
  • Is disallowed by robots.txt
  • Isn't linked from my other pages (although it does have at least one external link after 15 years)

I still get zero spam at that address. How much of that can be attributed to the JS obfuscation compared to the other protection measures is impossible for me to know.

I would not recommend putting all your team members email addresses on your website with obfuscation. Even if bots can't read the emails, you don't want anybody to be able to copy all the email addresses by hand and email your entire office.

I'd recommend installing contact form software on your website that allows email to be sent to any of your team. I wrote a free, open-source, contact form that you can use. There are also good contact plugins for most content management system such as Contact Form 7 for WordPress or the Contact module for Drupal.

Improve this answer
2

It depends on the bot. JavaScript certainly still makes a difference (I'd say the majority of bots don't parse JavaScript), but there are no doubt some bots that can parse it.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.