I am currently in the process of making myself an employment website; the entire site uses a client-side rendering engine to dynamically load views. Because of this, the source of the page returns only the template elements. I have my e-mail address written in plain text in one of the views that is loaded after initial page-load. Is this safe from most spam bots? Or at the very least, is it anything I should worry about?

Please do not suggest adding an e-mail form or other techniques; I am not asking for alternatives, I am asking specifically about the security behind this method.

  • Just to clarify... your email address is not present in the initial response to the client, it is only requested later using JavaScript? And that is a second request made to the server? It is not already present in code as part of the initial request?
    – MrWhite
    Aug 14 '13 at 12:27
  • @w3d Yes. The initial page response is just header information and container divs. All page content is generated afterward by a subsequent ajax request for loading views.
    – Ari
    Aug 14 '13 at 15:04

Having any email address exposed you run the risk of having the spam bots collecting that email address, there are methods that I'll list that can help you but its just like a car alarm, a car alarm can help prevent your car being stolen but it doesn't necessary mean it can't. Bots are forever becoming more complex and many are rendering pages just like real viewers so its impossible for certain to hide your email address, however you can block the majority of them.


  1. Use a image this will block 99.9% of bots, if not 100% but of course people can't click or copy and paste.
  2. Use a JavaScript to hide email address blocks a lot but not all if they are rendering the pages.
  3. Most likely the best method but never used it, searched for it and so on, but the best method would be to fetch the email address when a user clicks and it asks for a captcha code, but this has the downside of annoying your audience.
  4. Yes, you don't want to hear it but there's many reasons why people use forms and this is one of the highest reasons, without a form you run the risk of your email address being collected, none of my methods and no methods completely stop spammers.
  • Just to clarify, I added the last line to my original question because I am not interested in hearing about alternatives; I have already done my research on these, and do not need to have them repeated. I am specifically interested in dynamic rendering, and how effective it is in deterring spam bots. For example, will it have over a 90% success rate? Do you have examples of people who have tried it? Do the majority of spam bots render pages like real viewers nowadays?
    – Ari
    Aug 14 '13 at 15:12
  • Well then there's a problem with your question because spam percentages will differ from one niche to another, and if your site is going to reveal lots of email addresses then you will be targeted as a honey spot. Take gumtree as a fine example, bots get written purely for harvesting gumtree and even though they have taken measures to protect peoples telephone number its not perfect and many programs exist, similar to craiglist harvesters, these use 'reveal' buttons that fetch the number dymanicly grab the content and not during page render. Aug 14 '13 at 19:03
  • While scrapers won't detect this specific bot written programs will depending on the growth and popularity of your site. The best method would be to have a reveal with a captcha, this again isn't perfect because these have been bottable for sometime too. Your never find the perfect method unless you require users to signup to view emails, and then you monitor for harvesting and ban for X page views per a min. As far as percentages, I don't theres any studies online for this, you'd need to ask the big corps and ask if they can reveal this data, Aug 14 '13 at 19:06
  • but I'd assume they wont because they want everyone believing there data is safe. Aug 14 '13 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.