Jason Hendriks

nicholaswilson

Hiding email addresses from spammers has a long history. There are some obvious golden goals, like making the process seamless to your visitors, and be practicable to implement. The one that often gets left out is accessibility, but in some areas this is actually a legal requirement.[1]
<h4>The method</h4>
To my knowledge, this plugin implements the best method so far devised. Credit goes to Roel Van Gils for this technique, which he calls Graceful Email Obfuscation.[2] The basic idea is actually very simple: use PHP and JS to hide the address effectively, and make sure the fallback can be used easily by blind or visually impaired users by using a text-based CAPTCHA.
The PHP code takes passed-in emails and generates simply-encoded string using alphabetic characters. It is therefore very hard to imagine what sort of spammer’s parser could possibly detect it. The only way is to load the whole DOM and jQuery to run the decryption routine. As far as we know, no bots go to those lengths, but it adds essentially no overhead if the theme or any other plugins already load jQuery; otherwise a fraction of a second might be added to page load.
<h4>Comparisons with other plugins</h4>
Amazingly, no other WordPress plugins seem to use this method, either offering very little spam protection, or not coping with JavaScript turned off (3-10% of users). <a href="http://www.privatedaddy.com/" rel="nofollow ugc">Private Daddy</a> comes closest, but falls at the last hurdle by offering an image CAPTCHA with no non-visual alternative. Clunky though my first code bash is, it seems to the best available at the moment if accessibility is really important to you (of course, if I did not think that, I would not have written this). There is a similar Drupal plugin.[3]
<h4>Comparisons with other methods</h4>
The most viable alternative methods are:
<ol>
<li>Using images (cf. <a href="http://www.facebook.com/" title="Facebook" rel="nofollow ugc">Visagefolio</a>). This requires typing and is a pain for everyone.</li>
<li>Poor “test [at] example [dot] com” style text replacements provide no protection and annoy users.</li>
<li>Clever things like outputting “moc.elpmaxe@tset” and using CSS unicode rules to reverse it. Unfortunately these cause trouble for the blind and in some browsers make it confusing to copy and paste the link.</li>
<li>Using XML comments or CSS <code>display: none;</code> to remove elements inside the link text. There is still no clickable link, which makes it hard for the blind to use.</li>
</ol>
<h4>JavaScript fallback</h4>
If there is no JavaScript, the user is taken to a page on the site using an empty content box where they are asked a simple text question to check whether they are a human. Basic sums are asked at the moment, though a wider range of questions could be added using the <a href="http://testCAPTCHA.com" rel="nofollow ugc">testCAPTCHA.com</a> service.
<h4>References</h4>
<ol>
<li>See particularly ‘508’ legislation in America.</li>
<li>Original description on <a href="http://www.alistapart.com/articles/gracefulemailobfuscation" title="A List Apart: Graceful Email Obfuscation" rel="nofollow ugc">A List Apart</a>.</li>
<li><a href="http://drupal.org/project/geo_filter" rel="nofollow ugc">Drupal plugin</a></li>
</ol>
Further reading:
<ol>
<li><a href="http://technology.kencarlson.org/general/graceful-e-mail-obfuscation/" rel="nofollow ugc">GEO review</a> by Ken Carlson</li>
<li>Spam obfuscation comparison recommending use of this method for 508 compliance: <a href="http://doteduguru.com/id415-e-mail-obfuscation.html" rel="nofollow ugc">.eduGuru article</a> by Michael Fienen</li>
</ol>
Some notes and future details on <a href="http://www.nicholaswilson.me.uk/2010/04/notes-on-good-email-obfuscation/" rel="nofollow ugc">my site</a>

Graceful Email Obfuscation

Hiding email addresses from spammers has a long history. There are some obvious golden goals, like making the process seamless to your visitors, and b …

Ashok Dhamija

Unsolicited email or email spam is a huge problem that netizens have to face on daily basis. It is estimated that about 90% of all emails sent are spam mails. It was estimated that spam cost businesses to the order of $100 billion in the year 2007 [source: Wikipedia]. Spammers use email harvesting spambots or email spider software to automatically collect email addresses displayed on websites. Therefore, displaying email addresses on your websites can be an invitation to the spammers to collect your email addresses and then start sending you spam mail. At the same, it may be necessary to show your contact email addresses to the genuine visitors to your website. So, what is the solution?
TG Email Protection plugin provides a solution to this issue. Obfuscate or hide the email addresses from the spambots or email spider software, while at the same time displaying the same email addresses to the genuine visitors. Thus, while genuine visitors can see your contact and support email addresses and other email addresses displayed on your websites, the email spider software and spambots cannot automatically harvest your email addresses. For this to happen, obfuscation is used to hide the email addresses included in your WordPress website or blog from spambots and email spider software. This plugin uses different methods to achieve this twin objective in order to fight spam mail and to protect your email addresses. More methods of obfuscating email addresses to conceal them from email spambots may be added to the plugin in future.
How does the plugin obfuscate an email address? In fact, the plugin uses fast and efficient search of the content being delivered, to search for all email addresses in your content and then to obfuscate them on-the-fly. It happens whenever a page is about to be delivered to your visitor. The contents of your database are NOT changed by the plugin. What the plugin does is something like this: when a visitor requests a post or page to be displayed in the browser (by visiting its URL), WordPress extracts the relevant contents from the database; it is at this time that this plugin steps in and filters these contents in a fast and efficient manner, searching and obfuscating the email addresses found in such contents which have already been extracted or copied from the database. Thus, the contents of your database are not changed at all by this plugin. Only the (copy of the) contents being shown to the visitors are shown in a different (obfuscated) manner. While the visitor will still see the email address as usual, it will be obfuscated or hidden from the email spambots and spider software.
Two options to obfuscate email addresses
TG Email Protection plugin offers two different options for obfuscating your email addresses, while at the same time displaying them to the genuine visitors:
<ul>
<li>Select to automatically obfuscate all email addresses shown on your website. When this option is selected, the plugin will obfuscate all email addresses in your content being delivered to the visitors on-the-fly. When this option is selected, you may still separately and individually disable (or enable) obfuscation of email addresses from specific parts of your contents being delivered, such as the main contents, title, excerpts and comments of the post or page, and also from the blog description / information and widget texts. Email addresses in mailto: format are also supported with this option.</li>
<li>Use a shortcode to selectively protect or obfuscate each individual email address that you want. Shortcode can be used only when the above setting for automatic obfuscation of email addresses on the website is NOT selected; otherwise, shortcode will NOT do anything. So, please use shortcode only with this understanding. This is for the obvious reason that where you have already selected the option to obfuscate all email addresses on your website, all email addresses are in any case being obfuscated so that there is no need to use shortcode to obfuscate an individual email address. To use shortcode, use format like this: [tgemail]person@example.com[/tgemail], where person@example.com is the email being obfuscated. Put this shortcode in any of your posts, pages or widgets, wherever you want to display the email address. Please do NOT use shortcode for email in mailto: format.</li>
</ul>
Additional options of changing @ and . (DOT) symbols in email addresses:
TG Email Protection plugin provides you an additional (optional) measure to further obfuscate the email addresses by replacing the @ and . (DOT) symbols in email addresses by something like ‘ (AT) ‘ and ‘ (DOT) ‘ respectively or some other similar text to be chosen by you. While a user can obviously understand what such text stands for, an email spambot may not be able to know that, more so if you use your own custom text which can properly explain its purpose of replacing the @ and . (DOT) symbols in email addresses.
Once installed, the settings of the TG Email Protection plugin would be available for being changed from the ‘TG Email Protection’ option in the ‘Settings’ menu on the admin screen (back-end) of your WordPress website or blog.
Detailed instructions have been provided on the settings / options page of TG Email Protection plugin in the admin area. Each setting has been explained in detail.
You can use this plugin and test the results of obfuscating the email addresses from spambots. In our extensive tests conducted with several email spiders and spambot software, we have found that this plugin is completely successful in hiding the email addresses from the spammers by using innovative and randomized techniques.
This plugin works on all WordPress websites or blogs. It is a very light-weight plugin.
About the plugin and our other plugins:
This plugin has been developed by <a href="http://tilakmarg.com/dr-ashok-dhamija/" rel="nofollow ugc">Ashok Dhamija</a>, who has also developed few other plugins, such as the following:
<ul>
<li><a href="https://wordpress.org/plugins/tg-facebook-comments/" rel="ugc">TG Facebook Comments</a>.</li>
<li><a href="https://wordpress.org/plugins/tg-copy-protection/" rel="ugc">TG Copy Protection</a>.</li>
<li><a href="https://wordpress.org/plugins/tg-customized-tags/" rel="ugc">TG Customized Tags</a>.</li>
</ul>

TG Email Protection

Protect email addresses from being harvested by spammers and spambots, obfuscating them. Your visitors can still see email addresses.

Graceful Email Obfuscation vs TG Email Protection