What's a good way to list a "Contact Us" email address on a web site, while reducing the likelihood it will get spammed?

Is putting the email address in an image the best technique, or are there others?

  • 37
    Be aware that anything that beats a bot will also probably beat a visually impaired user
    – MrChrister
    Commented Jul 8, 2010 at 20:47
  • 1
    – gnarf
    Commented Jul 13, 2010 at 6:18
  • @MrChrister ...and white on white beats the user but not the bot. Commented Sep 17, 2010 at 7:34
  • 2
    Turns out... somebody setup a honey pot and collected results over a longer time length. Here are the results... superuser.com/questions/235937/…. Apparently, using CSS to change the direction of the address and/or inserting arbitrary hidden code into an email address are the best solutions. Apparently, OCR isn't a commonly item in the spambot toolbox. Commented Jan 21, 2011 at 23:29
  • har, i didnt even remember i answered a similar question to the superuser-one here :)
    – akira
    Commented Feb 17, 2011 at 17:13

27 Answers 27


I pass all contact forms through a throwaway Gmail account, that forwards mail to the real email address. It's free, it's easy, and Gmail's spam detection is top notch.

It requires no extra effort when making the website, and if anything gets through you just login to the Gmail account and flag it as spam.

You can then set the Gmail inbox to either automatically archive anything that has been forwarded, or even delete it if you don't want that extra copy kept there.

  • 2
    I have a Google Apps account which I use in a similar manner. The advantage of Google Apps over a Gmail account is that you can create up to 50 email aliases (nicknames) per account. I used to use Gmail accounts for stuff like this, but I would always forget the login info 1 year later and it was more of a pain that with Google Apps. (Still a great technique. +1)
    – jessegavin
    Commented Jul 12, 2010 at 14:59
  • +1 but I can see a downside - some people would trust an email from your own domain, rather than one setup using a free email provider.
    – Lazlow
    Commented Jul 13, 2010 at 20:53
  • 6
    Lazlow: I should've been more clear. I had that issue at first, so I currently setup a mail redirect using the site's domain, that redirects to a Gmail account, that forwards to my personal email address (which is another Gmail account), which tags it with a label defining which site it came from and skips the inbox. People think they're emailing [email protected] or [email protected] but they all come to my primary Gmail account and sit in labels for mydomain, myotherdomain, etc.
    – Callan
    Commented Jul 14, 2010 at 15:48
  • 1
    Gmail also allows you to response with email address that you have verified. So you could respond from within gmail as "[email protected]", though the actual email would specify a subtle difference like "sent on the behalf of [email protected] by [email protected]". Few are even likely to notice that you're using gmail to actually send as if from another address.
    – Kzqai
    Commented Jul 16, 2010 at 17:38
  • @Lazlow read @jessegavin comment above
    – Sruly
    Commented Aug 6, 2010 at 10:41

Use an email obfuscator

  • @DougHarris Do you (or anyone else) happen to know about a newer study about this (this one is close to 10 years old) ? How well do these methods work today ? I haven't been able to find a newer study. Commented Jan 12, 2017 at 16:50

My non-answer is to not do this. Modern email systems, such as GMail and the Barracuda anti-spam appliance, do an excellent job of filtering spam. Any barrier that you put between you and your visitors means a lower level of engagement and, depending on the type of site, potential loss of sales.

If you are worried about users who don't have native mail client installed, or who don't have the mailto: handler set correctly, then have a Contact Us page with BOTH the linked email address and a form (without a CAPTCHA) and let the user choose.

Spam is annoying, but it's our burden to bear, not our users.


Use natural language to spell out the eMail address...


thatguy at gmail dot com

You'd be surprised how much harder it is to write a bot that can differentiate natural language vs writing a bot that just searches for the @ sign and regexes a normal address.

It isn't 100% foolproof but it isn't any worse than obfuscation and it won't alienate your visually impaired users and/or users that have JavaScript disabled.

Update: Here's an example of this technique in action.

Update 2:

It turns out that someone has actually done research on this and posted it online. See the SuperUser post describing the results or the original article

  • 6
    I tend to question this approach. Mainly because it has been around for a quite long time and I can't imagine any email crawler developed during the last 10 years that would not start each new page by replacing "at", "[at]", "dot" or similar with their respective characters.
    – hultqvist
    Commented Jul 9, 2010 at 10:27
  • @phq Why? Is it so hard to believe that there aren't crawlers that can defeat all of the JavaScript and encoding obfuscation options by taking a snapshot of a page, running OCR, and regex for @? Just because it is possible to create a bot that can workaround all of these techniques doesn't mean that spammers will. The advantage of using natural language is it's use is a lot more diverse than a standard email URI. The @ symbol usually doesn't. Commented Jul 9, 2010 at 21:38
  • 2
    @Evan, my point is that this technique has become too common which usually is a problem when fighting spam. I claim that this technique is not a natural language technique, that would be something like "Email me at the domain example with the tld com and the username foo". The "at" technique is only a symbol replacement technique.
    – hultqvist
    Commented Jul 10, 2010 at 13:13
  • @phq I'd argue that cheap javascript obfuscation techniques have been around just as long and are just as easy to break. The point is, it won't eliminate page scrapers from capturing emails from pages, but it will 'reduce the likelihood' like the question suggests. Plus, it's the easiest option to implement without alienating your users. I don't see how your point makes this option any worse than any of the others. Commented Jul 11, 2010 at 21:28
  • 1
    I've also seen thatguy funny-symbol gmail.com
    – rlb.usa
    Commented Jul 15, 2010 at 19:11

Personally, I don't display email addresses on sites, but instead have an easy to use, accessible contact us form, along with an indication of who the email is from; allowing users to send the site owners and operators emails, without exposing email addresses or having to jump through various JavaScript hoops, etc.

This is often the best way to go if your spam filtering isn't that sophisticated.

  • 2
    There are lots of spammers now that fill out such contact forms.
    – txwikinger
    Commented Jul 9, 2010 at 18:57
  • 4
    I never fill contact forms. If I can not find a contact eMail then I simply do not do business with that company. Now, if it is a must for me and there is no contact eMail, I prefer to call by phone, even internationally. The problem with contact forms is I can never be sure if they will forward a copy of the typed information to my eMail address so, I am obligued to copy-paste the information to somewhere to keep track of the details.
    – vmarquez
    Commented Jul 9, 2010 at 19:22
  • @vmarquez: Fair enough. Would you be happy if there was an option to forward the mail to your address too? I've got a number of clients who want to enable their users to email them in a way that works in an accessible, non JS enabled way, without exposing their email addresses to spammers. They do have their phone numbers on their sites, so you would be able to contact them that way; Out of curiosity, do you record your phone calls with companies to keep track of them as well (seeing as most claim to record them for training)? Commented Jul 9, 2010 at 19:59
  • 2
    @Zhap: You are right, I am happy if the page with the form have a note indicating that I will get a copy of my request by eMail. Some Sites include that note and I use the form. For the cases where I need to call by phone I do not do my request during the call. I ask for an eMail instead and proceed to eMail them. I prefer the initial contacts to be made by eMail because I tend to make product/services research in behalf of many clients and that way I keep a detailed trail of what was asked/answered in each case.
    – vmarquez
    Commented Jul 10, 2010 at 9:23
  • @vmarquez: Couldn't you fill out the form, and then save / print to PDF the filled out form? Commented Mar 5, 2011 at 22:33

use css to hide some noise from the real text (just all in one line, i formatted it to better illustrate the technique):

u<span class="spam">noise</span>ser
@<span class="spam">noise</span>
example<span class="spam">noise</span>

and then use this little css-snippet:

.spam { display: none; }

if you need valid mailto: content, then you have to create it via jscript in the dom, see some of the other answers for that. but i am not a big friend of that.

  • does this work for selecting the text? Commented Jul 9, 2010 at 20:21
  • 3
    This isn't accessible though, since screenreaders tend to ignore stylesheets. Commented Jul 12, 2010 at 15:53

What I do is write out the email address as words, wrapped in a span tag: <span class="email">joe dot blow at gmail dot com</span>. Then a page-level script runs, grabbing any such spans and replacing each with a constructed email link. It may not be too obscure, but I've had no complaints. Plus if JavaScript is disabled, the user can still read the actual span text.

  • This won't be of much help against good bots. If the bot runs the JavaScript (which isn't a big thing to do - run the page in a browser engine and grab the generated HTML) it has a perfect address. Catching someone at gmail dot com is not a little bit harder than catching [email protected] Commented Jul 17, 2010 at 6:26

The best solution: use a spam filter.

I actually use Gmail to handle my POP3 email account for my business, because it's much easier to check email on different computers. Gmail's spam filters are the best in the world.

So you can just display [email protected] as your email address and forget about spam.

  • +1, Spam Assassin can also be tuned to be extremely effective for those who don't want to use Google.
    – Tim Post
    Commented Jul 28, 2010 at 19:06

using html encoding like &#649&#7854&#7575, the browser will render it like "abc"

  • 1
    I've used this technique before and it seems to work well. It's also transparent for users and doesn't rely on JavaScript :) Commented Jul 15, 2010 at 19:16
  • It would be a royal pain to write a bot to parse that text. On the other hand it's pretty obvious it's an e-mail address or something sensitive. Commented Jul 17, 2010 at 6:30
  • Actually, it would be really easy to write a bot to parse HTML entities. Deciphering encoded text is something that computers do quite readily, but humans have a lot more trouble with (which is why your browser does it for you). Which is why it's sorta odd that this method is still effective. Commented Nov 1, 2010 at 0:11

Use a graphic library (such as GD which is supported by PHP, or similar) to dynamically create .png images containing the email addresses.

Compared to my other answer this solution is less annoying for the users (but not transparent; they can't copy & paste it but must re-type it from scratch) but is also less secure: a computer can potentially read the unobfuscated image.

But overall I think it's a good compromise; it will stop the vast majority of spam bots.

  • It will also annoy the vast majority of users. No click, no copy-paste, gee, thanks, this is especially annoying on a small device like a phone, where you can't really type fast. Commented Jul 17, 2010 at 6:33

A quite good, while not perfect way is to create the e-mail address via javascript. Most spiders looking for e-mails do not execute javascript, and hence do not find a readable e-mail address.

Here is just one example how it could be done.

  • 3
    what about users that don't have JavaScript enabled? Commented Jul 9, 2010 at 8:56
  • 1
    @Evan: Who, in this 21st century, disables JavaScript, except those rare sysadmins browsing the web from a production box? ;-) Commented Jul 9, 2010 at 22:26
  • 1
    @Chris, I only turn Javascript (or cookies) on, if there's something specific I want from the site that requires it (like this site, for example). Of course, I may be the last of my kind... :)
    – Cyclops
    Commented Nov 28, 2010 at 14:22

I use a simple Python script to convert the e-mail address into an mailto link where the e-mail address is HTML entity encoded. This is completely transparent to the user, but seems to obscure the contents enough to defeat most simpleminded harvesting bots.

#! /usr/bin/env python3.0

def entity_encode(text):
    out = ""
    ba = text.encode()
    for i in range(len(ba)):
        out = out + "&#x{0:02x};".format (ba[i])
    return out

def print_email_link(address) :
        print('<!-- {0} -->'.format(address))
        print('<a href="{0}{1}">{1}</a>'.format(entity_encode("mailto:"), entity_encode(address)))

print_email_link("[email protected]")

This gives the output

<!-- [email protected] -->
<a href="&#x6d;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#x74;&#x65;&#x73;&#x74;&#x31;&#x32;&#x33;&#x40;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x63;&#x6f;&#x6d;">&#x74;&#x65;&#x73;&#x74;&#x31;&#x32;&#x33;&#x40;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x63;&#x6f;&#x6d;</a>

When the result is pasted into a web page, the browser displays the text "[email protected]" as a hyperline to "mailto:[email protected]", so it is just as convenient to the end user as including the address in the clear. But it does seem to defeat many harvesting bots.

Obviously, I delete the comment with the plain ASCII version of the address once I've pasted the obscured e-mail link into the appropriate spot in web page's HTML source.


Ask the user to resolve a CAPTCHA before showing them the email address (or if you have a contact form, before letting the user submit it).

It's the most annoying for the users but definitely the most effective.

  • 9
    I don't know which is more annoying, having to enter captcha or clicking an email link getting an outlook express setup wizard. It obviously depends on the audience but I think the contact form is the way to go.
    – Gabriel
    Commented Jul 8, 2010 at 23:40
  • @Gabriel: Captcha is definitely annoying but I completely agree with you. I wish people stopped using mailto. Easy enough nowadays sending e-mails directly through the server.
    – Omar Kohl
    Commented Jul 9, 2010 at 7:58
  • 1
    CAPTCHA is not a solution IMHO. Don't punish your users for other's sins. You are placing the burden on your users where there are other solutions.
    – vmarquez
    Commented Jul 9, 2010 at 19:16

I'm a fan of obfuscation, where the email address is essentially rendered with Javascript.

For example, [email protected] could be rendered as

<a href="javascript:location='mailto:\u006d\u0079\u0040\u0065\u006d\u0061\u0069\u006c\u002e\u0063\u006f\u006d';void 0">
<script type="text/javascript">document.write('\u006d\u0079\u0040\u0065\u006d\u0061\u0069\u006c\u002e\u0063\u006f\u006d')</script></a>

As far as the user is concerned, it's normal text and can be copied and pasted. Bots on the other hand will have a harder time with it.

Here's the obfuscator I used.

  • You could also use <a href="#" onclick="document.location.href='mailto:...'; return false"> Commented Jul 8, 2010 at 23:19
  • Those two solutions won't work too well without JS though, right? Commented Jul 9, 2010 at 6:35

One way:

  <script language="javascript"> 
  var name = "user"
  var host1 = "gm"
  var host2 = "ail.com"
  var addr =
  document.write("<a href=mai" + "lto:" + 
    name + "&#64;" + host1 + host2 +
    ">" + name + "&#64;" + host1 + host2 + "</a>")

You can write "Unscramble my email: user at com dot gmail" in <noscript> tags for those who have javascript turned off. This way you get the hyperlink functionality. You have a good chance at keeping spamers away from your address and people with javascript turned off or text only browsers can still get your email address.

  • I use the same, with multiple vars - as to me it would appear harder to piece together the individual values, for a bot.
    – Lazlow
    Commented Jul 13, 2010 at 20:59

All the obfuscation techniques in the world can't help in the long run if you get a lot of people contacting you. All it takes is for someone to drop you a message and later get infected by some malware that scans their inbox / sent mail / address book /whatever for valid addresses, andyour address it out there being passed from list to list [I even have contacts who are stupid enough to put there email address and password into online forms for the most idiotic of reasons, you probably have too, the most recent one was a site that offered to compute someone's "email astrology chart and predictions" which immediately spammed all the fool's contacts with an invitation to the same site and <deity> only knows what other lists we are now on as a result].

The address on my public web-sites isn't just a throw-away address - it is on a throw-away sub-domain. If I start getting spam on that sub-domain I create a new one, update the sites where my contact details are listed, and a short time later I completely remove the sub-domain from DNS records. If you do this, or any other throw-away address techniques, make sure you make clear (on any page listing the address and in the footer of any mail you send using that address) that the address will change in future and if people can't get through they should check back to make sure they have the correct address.

This has the advantage of just being a simple address for people to click (if their browser+mailer are linked that way) or copy+paste without needing to use their brains to edit the address afterwards (I'm always surprised by how many otherwise intelligent and observant people can't get that sort of thing right). It also means my mail server doesn't spend its days bouncing messages sent to "random" addresses (aaron@, adam@, amy01@, ...) at the expired sub-domains. It also doesn't confuse screen-readers used by the blind or poorly sited.

Another option that I've not tried yet is to use an AJAX request to read in the email address and other details. This may be slightly more effective than document.write based obfuscation, though will add a little extra load on the web server.

I used to use "contact me/us" forms instead but I found that they get spammed as much as, sometimes more than, plain-text email addresses - sometimes by scripts that are trying to use the form to create an account somewhere rather than use it as a contact form.


If you have a bot filter (using 1x1px, subnet, known bots, jscript detection, http referrer and browser agent) you can simply not display the information if its a bot.

Solution in PHP:

if (!isbot()) {
  echo 'mailto:'.$email_address_for_real_people;
  else {
  echo 'mailto:yourself_bot@'.$bots_domain_address;
  • BTW, isbot() is a user-created function that points to whatever bot filter routine you have. Commented Sep 6, 2010 at 22:05

The easiest thing I've found is to use a contact form where there is a default address, but also the ability for the user to select who the communication should go to (marketing, sales, tech support, etc.). Then, based on the value of the drop-down the posted form data is sent by the server to the appropriate email address.

Run this contact list out of a database table so you can easily update/add entries to the drop-down. That way you're never exposing any sort of address to the wide world of spam bots, and still give your users a great way to send in feedback.


No way, Jose! - Yes way, Jose!

There is absolutely no way to 'stop' the harvesting of a href="mailto:" email addresses. It is long believed that using JavaScript is a good way of preventing most harvesting bots but nowadays bots are pretty damn good at defeating this method. They can also defeat images that contain email addresses, the same way they can defeat captcha using decaptcha software.

The better way!

The better approach would be to use a reputable mail service that provides good spam blocking. Google G Suite and Microsoft Office 365 use an algorithm that is unmatched to any software on market, mostly because they receive millions of emails a day and they are able to 'learn' and blacklist spammers long before they even attempt to email you.

In fact one year ago Google said its machine learning tech now blocks 99.9% of Gmail spam and phishing messages, local Microsoft Exchange and mail servers running behind plesk/cpanel are unable to compete with this protection.


Block spam by using a reputable mail service that is capable of AI machine learning. You can also take it one step further by preventing spammers visiting your site using Cloudflare which will detect a large majority of aggressive bots before they reach your site.


I've used [email protected] for years. Users typically know enough to delete the 'no-spam.'.

Otherwise, I just use a contact form with a 'captcha' and send the mail directly from the website.

  • 4
    I'm surprised your users know enough to delete the 'no-spam'. Usually making asumptions about users being able to think a step ahead leads to quite disastrous results. It wouldn't occur to me to remove the no-spam unless you add some note instructing me to do so (and even in that case many people don't read notes, pop-ups ...).
    – Omar Kohl
    Commented Jul 9, 2010 at 7:54
  • 7
    How do you know your users know to remove 'no-spam'? You're only going to hear from the ones who do :¬)
    – pelms
    Commented Jul 9, 2010 at 10:00
  • 1
    @pelms: Good point, but some consider that an advantage. It can act as an intelligence filter screening your incoming mail... Commented Aug 6, 2010 at 9:24

Here is another email obfuscator: Enkoder, from Dan Benjamin. It comes both as an online app and a standalone app for Mac.


One thing I do is use the API from http://www.stopforumspam.com to check for spammers. Feel free to contact me for details and I will be glad to help you with it!

Bud Manz

Manz Web Designs, LLC


If you don't mind using javascript, you can use something like ROT13 for obfuscating the email address. For example see this:

Personally, I prefer using a contact us form and not worry about the spambots, but of course it all depends on your requirements.


I use a PHP function to generate some javascript to output the the script at runtime. Note that you don't need PHP to generate the JS at runtime, you can generate the JS once locally and then include the static JS in your page.

You can also use the linked function with this snippet below to automatically obfuscate email addresses in given a given HTML (where $processedContent is the HTML):

 $emailMatches = array();
 $matchCount = preg_match_all('/(?:[a-zA-Z0-9_\.\-])+\@(?:(?:[a-zA-Z0-9\-])+\.)+(?:[a-zA-Z0-9]{2,4})+/', $processedContent, $emailMatches);

 if($matchCount > 0) {
    $emailMatches = $emailMatches[0];

    foreach($emailMatches as $email) {
    $replacement = createJSMailLink($email);

    $processedContent = str_replace($email, createJSMailLink($email), $processedContent);

If you're using a contact form, you could do the fun technique of using random names for your inputs.

For example, I make a contact form, instead of using email as an input, I would use liame, same with name (eman), and comment (tnemmoc). The bots don't actually know what those inputs do, so they just disregard them.


I've set up a Google Docs Form / Spreadsheet. I can check form entries once a day and my inbox isn't flooded.


Use Zoho Creator to set up a contact form. The feedback you receive will be stored on a database that you can access online & it will also be emailed to you.

Not the answer you're looking for? Browse other questions tagged or ask your own question.