WordPress.org

Ready to get started?Download WordPress

Forums

How to shroud an email address to prevent spam (35 posts)

  1. BuffaloPeaceHouse
    Member
    Posted 11 months ago #

    I would like to add a few email addresses around the site which are clickable (so I would like to avoid the Mary[at]yahoo[dot]com format] and am wondering about the easiest way to do this.

    I have read that there is a way to use JavaScript to shroud the address so that it is clickable AND protected from spam, but I don't understand how to do this. Can anyone provide super simple instructions, or another easy way to do this? I am very new to this stuff, thanks!

    The blog I need help with is buffalopeacehouse.us.

  2. esmi
    Forum Moderator
    Posted 11 months ago #

    Please do not try to obfuscate email addresses. It doesn't work to deter spam bots and the only people it hurts are those trying to contact you. Try using a contact forum plugin instead.

  3. BuffaloPeaceHouse
    Member
    Posted 11 months ago #

    Thanks esmi. Are you suggesting putting in a page where people have to email us through the site? I wouldn't mind doing that for certain things, but I would also like to list, for example, email addresses to contact certain individuals. Personally, I dislike having to submit my inquiry to a contact us page (don't know if this is the best way to refer to it) and would rather just find an email address or phone number.

    Suggestions?

  4. Andrew
    Forum Moderator
    Posted 11 months ago #

    @esmi, just wondering what your opinion is on displaying the email address in an image instead, does that work?

  5. esmi
    Forum Moderator
    Posted 11 months ago #

    No. In order to make it accessible, you need to add the "real" text as an alt attribute - which would pretty much defeat the object of the exercise.

  6. Ihor Vorotnov
    Member
    Posted 11 months ago #

    If you still need to put obfuscated but clickable email on your site, use this native WP function:

    <a class="email" href="mailto:<?php echo antispambot( get_bloginfo('admin_email', 'raw'), 1 ); ?>?subject=Hello" target="blank"><?php _e('Contact me', 'your_text_domain'); ?></a>

    Personally I hate contact forms and prefer to write emails. That's why I always have a "send me an email" link on any website. And I don't receive tons of spam. 10-50 spam messages a day, sometimes a bit more. I use my Gmail account from the first days of Gmail service existense and use it everywhere on the forums, blog, promotion websites etc. For such an old and populated email even 100 spam messages a day isn't much.

  7. catacaustic
    Member
    Posted 11 months ago #

    Any function like antispambot() will make it look to you like it's obfuscated, but almost every email harvester out there knows that trick and is smart enough to translate the HTML entities to their actual characters before it scrapes the page.

    As far as SPAM goes, 50-100 a day is pretty big. I have one site that I have an email address on and that gets 20-50 a day - but as a comparison I've got another site that has been live for 5-6 years with a contact form and no email address displayed and that gets exactly 0 SPAM messages a day and always has. I guess this all depends on how much SPAM you want to get rid of.

    As esmi said way back at the start, obfuscating the email address will never work. Any method that can be reversed by a browser of a script can be reversed by a harvester bot. The only way to stop your email address being harvested is to not have it anywhere on the site.

  8. Ihor Vorotnov
    Member
    Posted 11 months ago #

    Yes, I've heard a lot of horror stories about super smart harvesters. In our company we did a test. Created a site, created 2 brand new emails, published them on tthat website. 1st email was obfuscated, 2nd one - plain text. After 6 months we checked inboxes and spam folders. 2nd one was full of spam - more then 14000 letters. 1st one had less then 800. Conclusion: obfuscation helps. Not a 100% protection, definitely, but makes huge difference.

    And one more thing to consider - emails on your custom domains are getting spammed automatically. There's no need to harvest emails, just prepend domain name with a list of popular/standard names like admin, info, support, sales, office etc and you got it. And many standard cPanel setups on shared hosting accounts by default enable collecting emails sent to unknown address on the domain to primary account. In this case send email to any_combination_of_characters@domain.com and it will be delivered to primary account.

    Use Gmail. Obfuscate email address on the website. Stop worrying about spam. Works for years.

  9. Ihor Vorotnov
    Member
    Posted 11 months ago #

    catacaustic, seems like contact form on your website is completely broken. See the screenshot: http://snag.gy/sQuB1.jpg

    This NEVER happens to mailto: links :)

  10. catacaustic
    Member
    Posted 11 months ago #

    I know... Trust me I know.

    That's a relic of the past that hasn't been fixed yet (clients projects take precendece over anything internal).

    But that still doesn't take away from my points. I also don't get SPAM from that email address because it's not visible on the site anywhere, which is the entire arguement. Like I said, if you're happy with the amount of SPAM you get then great, but it's not for all of us. :)

  11. Ihor Vorotnov
    Member
    Posted 11 months ago #

    I completely agree with you. Same with contact forms. There are some people who just don't like to submit them. Personally I'm trying to keep a minimalistic and 'lazy' approach - the less actions needed from user and the more straightforward they are - the higher conversion we get. Even 100 spam emails daily (and they are automatically filtered by Gmail anyway) is a small price for that.

  12. esmi
    Forum Moderator
    Posted 11 months ago #

    Please be aware that, if your obfuscated email address is not accessible to disabled users using a range of software and equal access is mandated by law in your country, you may be placing your site on the wrong side of the law.

  13. Ihor Vorotnov
    Member
    Posted 11 months ago #

    esmi, thanks for pointing it out, didn't knew that. Anyway, in my country (Ukraine) there's no such laws, so I'm safe. And I use descriptive alt attributes for screen readers. I suppose it will read 'Send an email to blog author' instead of reading the email address itself. Am I right?

  14. esmi
    Forum Moderator
    Posted 11 months ago #

    Yes but not all disabled users will be using screen readers. What about braille readers etc?

  15. Ihor Vorotnov
    Member
    Posted 11 months ago #

    It may be a problem, but again - not in my country. I have access to visitor stats for more than 150 websites, some of them are number 1-3 in my country in their niche (large news sites). We did a small research once, looking for any non-standard content readers. We were able to identify few screen reader visitors (few among millions) but no braille or of other type. Seems like in my country, unfortunately, blind people don't use internet or special tools. But I have some websites in english as well, they are oriented on worldwide auditory, will do a research on this topic and look for some solutions. Thanks for pointing me out.

    BTW, checked some top local websites for proper use of alt attributes. No one is using them properly... I usually spend a lot of time writing proper alts and translating them. I develop all themes originally in english and then translate them to russian or ukrainian with POEdit, even for commercial projects for local markets. This way if they decide to add another language to their site they are ready to go right out of the box.

  16. Ihor Vorotnov
    Member
    Posted 11 months ago #

    And, for example, what about taking care of blind users for portfolio website? I think it just makes no sense. The core part of the site content is visual, it's impossible to show photography or graphic design portfolio with words.

  17. esmi
    Forum Moderator
    Posted 11 months ago #

    We were able to identify few screen reader visitors (few among millions) but no braille or of other type.

    ah - but does that mean that your site was not accessible to them? You cannot rely on stats for this.

    The core part of the site content is visual

    And? Are you suggesting that people with a visual impairment should not be allowed the same ease of access as everyone else? Were you aware that perhaps only 5% of registered blind people actually have no sight? And that they will all have family members and friends who do not have any sight issues? Surely it is up to the individual surfer as to what sites they want to visit - not you?

  18. esmi
    Forum Moderator
    Posted 11 months ago #

    checked some top local websites for proper use of alt attributes. No one is using them properly

    So what? That does not make them right. And do ensure that you are differentiating between alt texts for decorative images and alts for informational images.

  19. Ihor Vorotnov
    Member
    Posted 11 months ago #

    ah - but does that mean that your site was not accessible to them? You cannot rely on stats for this.

    For a large news site we did a deep research, surveys, analytics and polls. It appears in my country blind people almost don't use internet directly, they ask for help of their friends or family if they need something. In US and other top countries it's ok for disabled people to have a normal life. Unfortunately, in my country it's not the same. We have not solved yet problems with elevators for disabled people at shopping malls and street crossings and you are talking about internet.

    And? Are you suggesting that people with a visual impairment should not be allowed the same ease of access as everyone else?

    Okay, I can make it accessible, but for what reason? A photographer's portfolio is showcasing photographs. Blind people can read what is the photo about and what is pictured on it but they can't see it anyway. I can do this extra work as a developer, but a client is not going to pay for that. He thinks blind person will not become a client. You can argue about the accessibility, the rights of disabled people etc but you can't blame a client of thinking about HIS business. A website is a converting platform and he will pay for anything that will make him new clients. But he is not going to pay for the features for blind people. And in this case the client IS right. So, when I give him a detailed cost estimate, he will review it and remove any parts of the work which are not needed for him.

    So what? That does not make them right. And do ensure that you are differentiating between alt texts for decorative images and alts for informational images.

    Of course, just gave you an example of a current state. And yes, I do differentiate alts and titles, alts for important stuff and decorations.

  20. esmi
    Forum Moderator
    Posted 11 months ago #

    I can make it accessible, but for what reason?

    To avoid discrimination for a start. And also because you have no idea what level of sight a specific user has or what they want to see. Making assumptions is dangerous.

    He thinks blind person will not become a client.

    Then I'm sorry but your hypothetical client is a fool. In the UK, it's been estimated that disabled people have disposable income of over 80 billion euros. Are there clients out there who do not want a slice of that market?

    Next, take the case of one of the world's largest grocery and internet companies. Many years ago, they decided to set up an "accessible site" for their disabled users (an approach that is now largely not recommended). It paid for itself within a year. After two years, it was out-performing the company's main online shopping site because non-disabled people found it easier to use. At the point the "accessible site" was scrapped in favour of accessifying all of their main sites when they realised that there was a really strong commercial case for accessibility. They now act as advisors to central government.

    Or then there's the case of the big insurance company that decided to accessify its sites because it was worried about being sued under discrimination laws. after about 18 months,. they reported the following:

    • A 30% increase in natural search-engine traffic
    • A significant improvement in Google rankings for all target keywords
    • 75% reduction in time for pages to load
    • Cross browser-compatibility increased (not a single complaint since the redesign)
    • Site now accessible to mobile devices
    • Time to manage content reduced from average of five days to 0.5 days per job
    • 95% increase in visitors getting a life insurance quote
    • 90% increase in Life insurance sales online
    • Savings of £200K annually on site maintenance
    • 100% return on investment in less than 12 months.

    They too are now public advocates of accessible web design.

    he is not going to pay for the features for blind people

    Who said he had to? Accessible design is not a premium add-on. It should always be part of all design projects. It's part of WordPress core.

  21. Ihor Vorotnov
    Member
    Posted 11 months ago #

    To avoid discrimination for a start

    Good point. I'm doing the most part of the job to make sites accessible as much as I can. But not always 100% usable and comfortable for ALL kinds of disabled people. Need to learn these in details.

    Then I'm sorry but your hypothetical client is a fool.

    1. They are not hypothetical, that's real situation with real clients. I hear it from 9 clients out of 10. Even when I start talking about features for disabled people they look at me like I'm an idiot.
    2. They pay for the development, they can insist or choose another company to work with. I prefer to have them stay - it's business.

    In the UK

    This is the main point. You live in UK and it's NORMAL for you. But hey, there's the rest of the world. I live in Ukraine. It's a poor country. We have no sound warnings for the green lights on the road crossings, no braille on product price tags or packages etc. Disabled people in our country ARE POOR. The government does not care about them. Often even families don't care much, unfortunately. This is sad. But this is reality in many countries, including all ex-USSR (and Russia to, believe me).

    Are there clients out there who do not want a slice of that market?

    These market in Ukraine is much, much, much smaller. I would rather say it's a micro-market. By the way, despite Ukraine is a large country and plastic cards are VERY common and popular (everyone have them) all over the country people still don't pay by card on the internet. Even on largest online stores the main (over 95% of orders) payment method is 'Cash on delivery'. This is just an example. Always remember that there is a lot of other countries outside UK and US and in many of them everything is COMPLETELY different. I saw many foreign companies coming to ukrainian or russian market and failing just because they were trying to work the way they work in their country. Always consider mentality and specifics of the country/people you are going to work with.

    Who said he had to? Accessible design is not a premium add-on. It should always be part of all design projects. It's part of WordPress core.

    You need to spend some extra time to double-check everything and even test (the perfect scenario). This takes time. Time means money. When the client says "let's see if we can cut off some costs" you start optimizing every step of yours. No responsiveness, no optimization for slower connections over mobile etc.

    Isn't dropping support for IE6-7 a discrimination? From my point of view, making a website 100% accessible is the same as making it work in IE6-8. If it's broken and visitors can't use it properly - it's bad. If it's working and users can use the most important features, even if they don't get all the pretty stuff and extra functionality - it's ok. Making everything 100% accessible and functional in all possible scenarios for every possible user is utopia.

  22. Ihor Vorotnov
    Member
    Posted 11 months ago #

    It's part of WordPress core.

    Oh.. :) WordPress core lacks some really important features. The most important part of these features is setting up and managing multilingual websites. Especially when you use one language with latin subset and another one with cyrillic. More that 36% of WordPress downloads are in other languages than english. Millions of websites are build on WordPress in 2 and more languages. And core support for this is really poor. WordPress team says it's a plugin area. With more that 1/3 of downloads? Come on. All the plugins over there have lots of weak points and limitations, they have different architecture and switching between them is impossible or very hard. And relying on a single plugin is stupid - if it stops updating or updates are late you can't use your site or forced to stay with an outdated version of WordPress. Developing and managing multilingual websites with WordPress is a nightmare. Believe me, it's my day-to-day job and I know it.

  23. esmi
    Forum Moderator
    Posted 11 months ago #

    You need to spend some extra time to double-check everything and even test (the perfect scenario).

    Only initially and whilst you are learning. Didn't you have to do the same kind of thing when you were learning web design generally? It can - and does - become second nature pretty quickly. And there are tons of support resources out there in the meantime.

    Isn't dropping support for IE6-7 a discrimination?

    No because that doesn't impact a specific group that can defined using other criteria. Web accessibility is specifically about making sites usable for disabled people. if a disabled person chooses to use IE7 and your site does not support IE7, then that's a different thing entirely.

    These market in Ukraine is much, much, much smaller.

    I do appreciate that but it will grow. The growth in other areas of Europe and the US has been quite amazing over the past 10 years. This is your chance to get in on the ground floor. :-)

    making a website 100% accessible is the same as making it work in IE6-8.

    You can never make a site 100% accessible as its level of accessibility is defined by whoever is using it. All you can do is make the site as accessible as possible by doing things the Right Way (ie according to the WCAG guidelines etc). If user X doesn't know how to use their assistive technology (AT) correctly, that's not your problem. Ditto if someone is using an very old or obscure user agent (such as IE6). These are not accessibility issues, But if you deliberately obfuscate your contact email address in such a way that it cannot be rendered by some AT, then that is an accessibility issue because you have created this barrier when there are barrier-free alternatives.

    Making everything 100% accessible and functional in all possible scenarios for every possible user is utopia.

    This is not about Utopia. It's about trying to ensure that you do not create barriers. Many disabled users are perfectly capable of wrangling their own software. They are experts in their field and their range of skills etc can be mind-blowing. Nor are they asking for special treatment. All that they do ask is that you do not make their lives more difficult if this can be avoided.

    Accessible design really isn't as scary as it might look initially. And the potential benefits for everyone are very significant.

  24. esmi
    Forum Moderator
    Posted 11 months ago #

    The most important part of these features is setting up and managing multilingual websites.

    Sorry but that's not an accessibility issue as it does not impact disabled people specifically

  25. Ihor Vorotnov
    Member
    Posted 11 months ago #

    It's about trying to ensure that you do not create barriers
    ...
    All that they do ask is that you do not make their lives more difficult if this can be avoided.

    Got it. Completely agree.

    A question. Ok, I have obfuscated email and some user agents can't understand the email address characters. Looks like a problem. But the tag has alt attribute saying 'Press this link to send me an email". I suppose this user agent can perform this basic action (following a mailto: link and sending email using a webmail or any mail client). Using contact form is actually the same - a visitor can send an email but he can't see the actual email address. So, every user, including disabled CAN use this feature. Looks like we don't have any problem here. Am I missing something?

  26. Ihor Vorotnov
    Member
    Posted 11 months ago #

    Sorry but that's not an accessibility issue as it does not impact disabled people specifically

    It impacts millions of people, including disabled. It's off-topic and completely different discussion but had to mention it when talking about critical WordPress core features.

  27. esmi
    Forum Moderator
    Posted 11 months ago #

    it impacts millions of people, including disabled.

    But not disabled people specifically - hence not a web accessibility issue.

    Definition of web accessibility
    W3C's definition

  28. esmi
    Forum Moderator
    Posted 11 months ago #

    Am I missing something?

    Not 100% sure. To be honest I'd need to see this in action and have the opportunity to ask a couple of other people with experience in this area to also have a look at it.

    If you're interested, I could ask for feedback on such a solution via http://make.wordpress.org/accessibility/

  29. Ihor Vorotnov
    Member
    Posted 11 months ago #

    https://creativemarket.com/badelt/7896-Righter-A-Simple-WordPress-Theme/live-preview

    Here's a demo of a Righter WordPress theme. I'm creating a Pro version of the theme with extra functionality and fixing some general issues for this version. Accessibility is on the list.

    Check the 'Contact me' button, bottom left. In the original theme it's not obfuscated, has no alt and title attributes etc.

    Original code (from the link above):
    <a target="blank" href="mailto:someone@gmail.com?subject=Hello" class="email">Contact me</a>

    My edited version:
    <a href="mailto:someon%65@gmail%2E%63om?subject=Hello" target="_blank" alt="Click here to send me an email" class="email">Contact me</a>

    It has alt attribute, it's a text link accessible by it's nature, the design (it looks like a button) is pure CSS. It functions well - opens a mail client's (or webmail's) 'Compose new message' screen and puts there recipient's email address and message subject. As I understand it's 100% accessible and operable. The email address itself isn't readable and it shouldn't actually. It's still accessible. Am I right?

    By the way, checked WCAG 2.0. Seems like I'm following these guidelines intuitively, I learned this in the process, not by reading the guidelines. Most of this is just a common sense and good practices.

  30. esmi
    Forum Moderator
    Posted 11 months ago #

    <a href="mailto:someon%65@gmail%2E%63om?subject=Hello" target="_blank" alt="Click here to send me an email" class="email">Contact me</a>

    Eek! target="_blank"? Please, please, don't spawn new windows without warning users on the page in clear text. It leaves some users (e.g switch users) stranded on the spawned window because it breaks the functionality of the browser back button. And why bother for a mailto link? At the most, it will just launch their email client.

    It has alt attribute, it's a text link accessible by it's nature

    Actually we (as in the make WordPress accessible group) have just had an online meeting and I brought this scenario up with a request for comments. The overwhelming consensus was that (as I suspected) it's not accessible. To be truly accessible, the alt must replicate the text rendered in the graphic - which totally nullifies the point of the exercise in the first place.

    Sorry. :-(

    Most of this is just a common sense and good practices.

    Absolutely - which is why I don't see it as a premium add-on service. Incidentally, have you tried putting your theme through the theme accessibility audit yourself?

Reply »

You must log in to post.

About this Topic