On https://www.heartinternet.uk/blog/15-ways-to-hide-your-email-address/, under the sub heading Replacing with a PHP script, a method to hide email addresses is presented that I like very much. On the user page in question one includes

<p>Please <a href="mailhandler.php">email us</a>.</p>

And mailhandler.php looks like this:

    header ("Location: mailto:[email protected]");

If the user clicks the 'email us' link, the computer responds with opening a New Mail window from its mail program, with the address filled in.

But is this method foolproof? This rationale makes me wonder: a bot visits every link it comes accross. In the case of the 'email us' link, it ultimately gets the command to open a New Mail window, which a normal browser passes on to the mail program. So, the only thing a spam bot would have to do is analyze that command correctly, and it has found another email address.

1 Answer 1


No method of obfuscation is fool proof. But the value of getting an email address for sending spam may not be worth the effort to the bots. The more noval or proprietary the method of obfuscation the less it becomes economical to harvest the emails. To un-obfuscate they need to re-write their harvester program.

In the case above, it looks like, (on the HTML page), a web based email. But then redirects to a email link. One could read the header of the mailhandler.php to see the email address, but if less than 1% of sites are using that method it would likely not be worth re-writing their harvester.

If 50% of sites are using that method, then it would no longer be effective.

  • 2
    I'm not even sure they would have to rewrite their bots. Email harvesting bots visits as many pages as possible and pull anything that looks like an email address off of them. The bots would already be crawling the mailhandler.php URL, they would just need to be smart enough to harvest the email address out of the Location: header. That technique may fool a few bots, but I doubt it would fool most bots. May 15, 2022 at 21:37
  • @StephenOstermiller — First of all, thanks for the edit of my question. It made the title clearer and added some valuable tags. But the method is not at all foolproof then, is it? Wayne — For the record, it's not a web-based mail that is generated, but a New Mail window from the computer's default mail program. May 16, 2022 at 9:58
  • @StephenOstermiller — Another question regarding such methods: Is it true that bots cannot create/simulate an onclick event? May 27, 2022 at 15:56
  • No. It is true that Googlebot doesn't simulate clicks, but that isn't a general limitation of all bots. Email address harvesting bots have a wide variety of sophistication and a few of them could have such capabilities. It is certainly true that using JavaScript, especially JS that requires user interaction, raises the bar substantially as far as how hard it is for bots. May 27, 2022 at 16:15
  • But just putting mailhandler.php into an on-click event doesn't mean that JavaScript would be required to find it's URL. Bots often scan JavaScript for things that look like links even if they don't execute that JavaScript. May 27, 2022 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.