Some tips to protect your email address against spam

🔊 Listen to this post Now in English

Disclosure of your email address is often essential, but involves a certain risk of a spam attack. Spam is not only annoying, but can present a serious security hazard, especially when it comes to phishing emails. This also includes malware that cybercriminals hide in email attachments. Necessity makes creative, however, so there are a number of tips on the Internet by which website operators can limit the access of spambots to their email addresses. I will compare these different methods and present their advantages and disadvantages.

Email collection: how spambots watch their projects

Email harvesting is the acquisition of email addresses for unfair advertising, phishing attacks, and the spread of malware. Specialized programs, which are email harvesting robots, or spambots, comb websites, contact lists, forums, and social networks for email addresses. The characteristic syntax of email addresses provides clues to identify the desired information. For example, bots search source texts with the @ sign. This is because this sign is not generally used as such in texts, but only to separate the username from the domain in email addresses. Descriptions also offer insufficient protection. Sophisticated spambots often include other spellings, such as [at], [AT], (at), or (AT) in their search:

user@domain.com

user [at] domaine.com

The HTML email reference is even more treacherous, as in the example “mailto: user@domain.com”. This allows visitors to a website to open their favorite email program with one click, and the recipient’s address is automatically copied into the corresponding field. This is certainly convenient, but it also makes it clear to spambots that this is an email address ready to be captured. Therefore, sometimes website operators try to force traditional templates to provide email addresses. However, it is important to maintain optimal readability for Internet users in order to allow barrier-free access to email addresses.

Classic formula of an unprotected email address

It is important to understand how an email address is integrated into a web page to better protect yourself from automatic harvester robot attacks. A simple and barrier-free device for an email address can, for example, be integrated into a page using the following code:

<p> For any further information, contact us by email
<a href=”mailto:user@domain.com”> user@domain.com </a>.
</p>

When a user visits a website with this code, the browser displays the following information, including a clickable mailto referral:

For any further information, contact us by email at: user@domain.com

From a user perspective, this is the best presentation of an email address on the Net. In order to preserve the user-friendliness of this presentation, the most popular methods of protecting their email address tend to make it invisible in the source text, without changing their appearance in the browser. It is also possible to separate the email address from the website and forward the mailto referral through a server. However, the display of the email address in the browser is less and less common. This is due to the lack of user comfort of this method, and its lack of effectiveness in protecting against spam.

To protect your email address from spam, effective methods are to replace it, hide it or encode it in the source text, which hinders spambots but not users.

Hide your email address

If you don’t want to completely replace your email address with an image or a mailto link, there are alternative strategies. In particular, it is possible to encode your email address, by integrating additional elements or first by compiling them in the browser using JavaScript. It is possible to create a simple encoding especially with HTML entities, as well as with URL and HEX encodings. The strategies for hiding your email address are based on the comments features, and the HTML andCSS elements. There is also a more complex solution, which consists of hiding your email using dynamic composition of the address.

This method means that the characters are simply transcribed, that is, it only involves manipulating the address in the source code: this does not change the way it is displayed in the browser.

Hide your email address by encoding characters

The usual character encoding, used to hide email addresses in the source code, is based on HTML entities, HEX code, or percent URL encoding. These descriptions were first developed to incorporate special characters among standard characters. This type of encoding is suitable for masking email addresses, since the characters in question are automatically transcribed in the browser. If the characters in the user@domain.com email address are masked by HTML entities, they are written in an alternate style first.

Encrypt your email address

JavaScript not only allows you to assemble email addresses in several parts, but also to encrypt your email address to protect it from spam, thanks to a particular language. One of the common methods for email encryption is ROT13, which can be implemented with just a few lines of JavaScript.

The captchas

Captchas also offer the possibility of protecting your email address from spam. Email addresses are encrypted and displayed in plain text only if verified to be a user and not a robot. These checks can take different forms, including asking the visitor to copy a combination of numbers and letters. It can also be easy calculations, puzzles or recognition exercises. Google offers a free CAPTCHA service with reCAPTCHA.

Captchas offer a higher level of spam protection compared to other methods, as email addresses are not displayed at all, or only in encrypted form in the source code. They are also easy to integrate into a website design. However, this method requires a certain effort to reach the email address, and greatly hinders user comfort, since the information sought is not directly accessible.

An alternative: the contact form?

To avoid revealing your email address on a website, many website operators offer to create contact forms, in which visitors can enter their message, name and contact address. These forms are integrated into a website using a server-side programming language, such as PHP. In order to prevent spambots from automatically filling out these forms, they are generally secured by captchas