Email Obfuscator & Harvester Shield

Shield public contact emails from automated harvesting scrapers and spam bots. Convert clear-text addresses into decimal entities, hexadecimal encodings, CSS bidi reversals, and JavaScript decoders.

Clear-Text Email Input
HTML Decimal Entities

Standard email spam scraper defense

HTML Hexadecimal Entities

Obfuscates raw ASCII character codes

CSS Direction Reversal (Bidi)

Displays correctly to humans, reversed in DOM

JavaScript Dynamic Decoder

Invisible to static regex scrapers

The Anatomy of Automated Email Harvesting

Every business requires public contact channels for prospective clients, enterprise procurement, and customer support. However, publishing raw clear-text email addresses (e.g. info@example.com) exposes your corporate domain to continuous automated reconnaissance.

Malicious threat actors deploy lightweight web crawlers that scan millions of websites daily. These bots do not render JavaScript or interpret CSS styling; they simply apply regex filters to raw HTTP response bodies. By obfuscating the underlying DOM syntax while preserving visual rendering, you neutralize over 90% of automated spam harvesting campaigns.

Email Obfuscation Techniques Comparison & Effectiveness

TechniqueUnderlying MechanismBot Scraper ResistanceUser UX ImpactRecommended Use Case
HTML Decimal EntitiesReplaces characters with s code pointsHigh against basic regex botsZero; native clickable mailto:General blog & footer contact links
CSS Direction ReversalInverts string in DOM; reverses visually via CSSVery High (Scrapes backwards text)Requires manual copy-pasteSecurity incident reporting emails
JavaScript Dynamic DecoderDecodes ROT13 string during client executionExtremely High (Requires headless browser)Zero; renders standard <a> tagExecutive & leadership contact pages

Anti-Spam & Email Protection Checklist

✓Never display raw unencoded email addresses in website footers or headers
✓Apply decimal or hexadecimal entity encoding to mailto: href targets
✓Deploy contact forms with Cloudflare Turnstile or reCAPTCHA for primary inquiries
✓Configure strict SPF, DKIM, and DMARC DNS records to prevent email spoofing
✓Audit your public domain DNS records using the WeSecureX DNS Lookup tool
✓Declare business contact details in Schema.org JSON-LD for search engine E-E-A-T

Frequently Asked Questions

Expert answers regarding email obfuscation, spam harvesting bot mechanics, and website security.

How do automated spam harvester bots scrape email addresses from websites?

Spam bots deploy automated regular expression parsers (looking for patterns matching `[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}`) across raw HTML responses and `mailto:` links. Once scraped, these email addresses are added to commercial spam lists and targeted with phishing attacks, credential stuffing, and brute-force campaigns.

How does HTML entity encoding defeat email scrapers?

Entity encoding converts standard ASCII characters into decimal (`&#115;`) or hexadecimal (`&#x73;`) code points. While web browsers automatically decode and render these entities as plain letters for human visitors, basic scraper bots searching for raw '@' symbols in HTML text fail to detect the email address.

What is the CSS Bidi-Override technique?

The CSS Bidi-Override technique writes the email address backwards in the HTML source code (e.g., `moc.elpmaxe@tcatnoc`) and uses the CSS style `unicode-bidi: bidi-override; direction: rtl;` to render it forwards visually to users. Bots scraping the raw DOM capture an invalid reversed string, making the scraped address useless to spammers.

Is JavaScript email decoding accessible to screen readers?

Modern screen readers (like NVDA, JAWS, and VoiceOver) execute JavaScript and interpret standard DOM nodes accurately. However, CSS bidi-reversals can occasionally confuse older screen readers unless paired with an `aria-label` providing the correct pronunciation.

Does obfuscating email addresses hurt technical SEO?

No. Search engines like Google do not require contact email addresses to be present in raw clear text to understand business contact entities. In fact, declaring contact details within structured `Organization` or `LocalBusiness` Schema.org JSON-LD satisfies Google's E-E-A-T requirements without exposing clear text to spam bots.

Can advanced AI scrapers defeat email obfuscation?

Basic regex bots (which account for over 85% of spam harvesting volume) are completely neutralized by HTML entities and CSS reversals. Advanced headless Chromium scrapers can execute JavaScript, but implementing contact forms with CAPTCHA or Cloudflare Turnstile provides secondary defense.

Should contact forms replace mailto links entirely?

Contact forms are the most secure method to prevent harvesting, as the recipient email address remains strictly on the server backend. However, many B2B customers and enterprise procurement teams prefer direct email links; obfuscation provides the ideal compromise.

Where should obfuscated code be pasted in our website CMS?

Paste the generated HTML snippet directly into your HTML template, Markdown file, or CMS code block. The browser will render a standard, clickable mailto link for legitimate human users.

Strengthen Your Website Security Perimeter

WeSecureX provides free developer utilities to audit search engine indexing, inspect security headers, and prevent data exposure.

Security Headers CheckerDNS & SPF/DMARC Lookup.htaccess & Nginx GeneratorView All Tools