Email Address Obfuscation
By enabling Cloudflare Email Address Obfuscation, email addresses on your web page will be hidden from bots, while keeping them visible to humans. In fact, there are no visible changes to your website for visitors.
Email harvesters and other bots roam the Internet looking for email addresses to add to lists that target recipients for spam. This trend results in an increasing amount of unwanted email.
Web administrators have come up with clever ways to protect against this by writing out email addresses, such as help [at] cloudflare [dot] com or by using embedded images of the email address. However, you lose the convenience of clicking on the email address to automatically send an email. By enabling Cloudflare Email Address Obfuscation, email addresses on your web page will be obfuscated (hidden) from bots, while keeping them visible to humans. In fact, there are no visible changes to your website for visitors.
Cloudflare enables email address obfuscation automatically when you sign up.
To disable Email Address Obfuscation in the dashboard:
- Log into the Cloudflare dashboard ↗.
- Select your account and website.
- Go to Scrape Shield.
- For Email Address Obfuscation, switch the toggle to Off.
To disable Email Address Obfuscation with the API, send a PATCH request with email_obfuscation as the setting name in the URI path, and the value parameter set to "off".
To prevent Cloudflare from obfuscating specific email addresses, you can:
-
Add the following comment in the page HTML code:
<!--email_off-->contact@example.com<!--/email_off--> -
Return email addresses in JSON format for AJAX calls, making sure your web server returns a content type of
application/json. -
Disable the Email Obfuscation feature by creating a Configuration Rule to be applied on a specific endpoint.
To prevent unexpected website behavior, email addresses are not obfuscated when they appear in:
- Any HTML tag attribute, except for the href attribute of the a tag.
- Other HTML tags:
- script tags:
<script></script> - noscript tags:
<noscript></noscript> - textarea tags:
<textarea></textarea> - xmp tags:
<xmp></xmp> - head tags:
<head></head>
- script tags:
- Any page that does not have a MIME type of
text/htmlorapplication/xhtml+xml.