A Simple and Effective Solution to Hide Email Addresses from Spam Spiders

December 2008

This article describes a simple solution to prevent spam spiders from picking up email addresses from a web page. It retains the user-friendliness of the mailto protocol allowing users to contact you through their preferred email program and is much simpler to deploy than a form-based solution since it does not require any server-side processing.

In fact, using an HTML form to hide emails from spam spiders has several down-sides. First, many users are wary of them since they know that most form collected info goes directly into a database for eternity and is (or can be) later used for unauthorised purposes. Second, when you send mail through a web form you do not get the added benefit of a new address (the to: address) recorded by your mail program. This has the drawback that your antispam agent will probably consider any reply to your message as unsolicited mail (i.e. potential spam).

The solution described here basically works by asking the user to answer a simple question before allowing her/him to open a mailto link. Since bots are basically stupid (when compared to most real people) they fail when confronted to a trivial question and thus are not allowed to access the email address.

This scheme would not be sufficient if we still had a literal mailto link in the html or javascript code. To this end, the other part of the solution is to assemble the email programmatically so it never appears in literal form on or in the web content. Furthermore, the mailbox and domain values can (and should) be obfuscated somehow (you must then pass along the de-obfuscating function) which makes it even more difficult for an automate to outsmart your email masking scheme.

Try it out

Note that the script checks for browser type and version and if IE version 7+ is detected, the user is not prompted with a qualifying question. This is because IE 7 blocks javascript prompts and asks the user to explicitely authorize them. If anybody has a better solution, we would be happy to hear about it.

Send mail to test at mydomain dot com

Sample HTML markup

This is the HTML fragment used for the above example.

Note that the mailbox and domain names (first two arguments passed to the ow_filterAndSendSmtpMessage() function) are obfuscated (actually they are spelled in reverse). The function to de-obfuscate them is also passed along to the function as the last argument. If obfuscating is not desired, simply specify null as the last argument. In the example, we use the current year as a qualifying answer but you could use a simple math question such as '2 + 2 = ?' or anything else that is extremely easy for a person but very difficult for a bot.

This solution is not bullet-proof. However, one can imagine and implement many variations in the question, the obfuscating algorithm and the way the mailing function is invoked making it very hard for a spider designer to keep up. In any event, spammers are interested by the numbers and will never spend time trying to reverse engineer an email hiding solution that can be changed the next day.

Source code

Get the JavaScript source code.

Resources

Check out these other resources for more info on masking email addresses from spam spiders.