How to Put Your Email Address on a Website Without Getting Spam

Don't publish a plain mailto: link; replace it with a snippet that keeps the address out of the raw HTML. The strongest option that still gives visitors a clickable link stores the address in reversed parts and only builds the mailto when someone hovers, focuses or taps. The email obfuscator writes that snippet and four simpler ones for your address, in your browser. Be clear about what this buys: fewer addresses lifted by simple crawlers, not zero spam.

Sources: Spencer Mortensen, Email obfuscation: what works?, which publishes addresses protected by different methods and counts the spam each receives; Cloudflare, Email Address Obfuscation. Both read 3 November 2026.

What obfuscation can and can't stop

Most address harvesters fetch the HTML of a page and search it for anything shaped like name@domain. Anything that keeps that pattern out of the source defeats them. A scraper that loads the page in a headless browser, runs its JavaScript and reads the result sees what a visitor sees, and no technique here holds against it. Spam from addresses that were leaked in a breach, guessed (info@, sales@) or bought elsewhere isn't affected at all.

The methods, and what each costs visitors

Method	Clickable link	What it costs
Split, reversed address; mailto built on hover, focus or tap	Yes	Needs JavaScript; fallback text without it
Link built by JavaScript, [at] [dot] fallback	Yes	Needs JavaScript
HTML-entity-encoded mailto	Yes	Works without JavaScript; a harvester that decodes entities reads it
Written out: name [at] domain [dot] com	No	Visitor retypes it
CSS-reversed text	No	Copies backwards; screen readers may read it backwards

Mortensen's results show large differences between techniques and that layering two does better than one, which is why the first snippet combines splitting with deferred building.

Steps

1. Type the address, and optionally link text and a subject line.
2. Pick a snippet; the first keeps a working link and combines two techniques.
3. Paste it into the page's HTML: a Custom HTML block in WordPress, an embed or code block in Webflow or Squarespace.
4. Check the live page on desktop and mobile, with the link clicked once on each.

If your site is proxied through Cloudflare, check whether Email Address Obfuscation under Scrape Shield is on. It rewrites addresses in the HTML automatically; adding your own snippet on top can leave visitors with a broken link.

When not to publish the address at all

A contact form keeps the address out of the page entirely. If you need an address on the page, publish a role address such as hello@ that you can filter, forward or replace; role-based email addresses covers the trade-offs. For an unprotected link with a preset subject and body, use the mailto link generator.

Limits

Nothing here stops a harvester that runs JavaScript and interacts with the page. The JavaScript snippets need script to be allowed; some site builders strip script tags from embeds. Reversed CSS text isn't reliably read by screen readers. And hiding the address you publish says nothing about the addresses people send you through the form.

Where SimpleVerifier fits

The other side of a contact page is the list it produces. Export the addresses from your form or signup tool and upload them at /verify: every address gets a live mailbox check, and valid, risky and invalid download as separate files, so typos and throwaway addresses don't go into your CRM. Toxic email addresses explains what to drop. The first 100 checks are free with a Google sign-in. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.