Protect my email

Free email obfuscator

Put your email on your site.

Keep it away from the bots that copy it.

Paste your address and get a small snippet. People see a normal link they can click. Harvesters see nothing they can use.

Protect my email See how it works

Works on WordPress, Webflow, Wix, Squarespace, Framer and plain HTML

Protect an address
Method
snippet.html
Type an email address above.
Paste it into an HTML or Custom Code block.

Harvester bots read the raw HTML of millions of pages and keep anything shaped like an email address. Email Protector removes the address from your source so there is nothing to keep.

How it works

Harvesters read your HTML, not your page.

Running JavaScript is slow and costly at scale, so most address bots skip it and pattern-match the source instead.

Before

What a bot reads now

<a href="mailto:hello@yourcompany.com">Email us</a>

Plain text in the source. Copied in milliseconds and added to spam lists.

After

What a bot reads with Email Protector

<a class="wep-mail" data-wep="2a272e2e…" data-k="66">Email us</a>

No address in the source. Your visitor's browser rebuilds the link when the page loads.

Three methods

Pick the strongest one your site allows.

HTML entities

The fallback

Each character becomes a code like &#104;. Simple bots are fooled; smarter ones decode it in one line.

Protection
Basic
CSS only

For builders that strip scripts

The address is stored backwards and flipped by CSS. Visitors copy it instead of clicking.

Protection
Good
JavaScript

The default. Use it where you can

The address is encoded in a data attribute and rebuilt by a one-line script. Nothing in the source looks like an email.

Protection
Strong

Statistics

The numbers behind the problem.

All statistics
44.99%of global email was spam in 2025Kaspersky · spam email statistics → 53%of web traffic was made by bots in 2025Thales · bot traffic statistics → 23.1%floor spam share across 993 contact formssplitforms · form spam statistics → 24new WordPress vulnerabilities published per dayWordfence · WordPress security →

For WordPress sites

Still running the old WebEmailProtector plugin?

It was closed on wordpress.org in May 2025 and gets no updates. An unmaintained plugin is a security risk.

  1. 01Note every page where the plugin shows an address.
  2. 02Deactivate and delete the plugin.
  3. 03Paste a snippet into a Custom HTML block in each place.
  4. Create a snippet

Coming next

Contact-form spam, stopped without a CAPTCHA.

A hosted form endpoint that filters bots with invisible checks: a hidden honeypot field, a time-to-fill check and a small proof-of-work. Real visitors never solve a puzzle, and you get a log of what was blocked and why.

Questions

Before you paste the snippet.

Does email obfuscation still work?

Yes. Most harvesters read raw HTML and look for text that matches an email pattern. If the address only appears after JavaScript runs, those bots find nothing. A scraper running a full browser can still get it, so obfuscation cuts spam a lot but not to zero.

Will the link still open my visitor's mail app?

Yes. The JavaScript snippet rebuilds a normal mailto link in the browser, so a click opens the email app as usual.

Is my email address sent to your server?

No. The encoding runs in your browser. Nothing you type here is uploaded or stored.

Does this hurt my SEO or accessibility?

No. Search engines don't rank pages by the email addresses on them. Screen readers read the finished link once the page has loaded. Use descriptive link text like "Email our support team".

Can I protect several addresses on one page?

Yes. Paste the script line once and repeat the link line for each address. The script finds every protected link on the page.

Protect your address in under a minute.

Protect my email Read the statistics