Stop Spambots from Stealing Your Emails and Text - Mystrika

Tired of spam bots scraping your emails and content? Obfuscation is a handy technique to conceal information from these digital nuisances. This comprehensive guide covers all you need to know to implement text and email obfuscation the right way. Learn effective methods to baffle bots without losing user experience. Find the best strategies to balance security, accessibility and usability when obfuscating your website content.

Page Contents

Understanding Obfuscation Techniques

Obfuscation refers to the deliberate act of making something difficult to understand or interpret. On the web, obfuscation techniques are commonly used to hide or “mask” sensitive information like email addresses, phone numbers, and URLs from bots and scrapers.
There are a few primary reasons why someone may want to obfuscate content on their site:

To prevent email harvesting for spam. Publicly sharing your contact info online often leads to a flood of unwanted spam messages. Obfuscation makes it harder for scrapers to easily grab email addresses.
To block malicious bots and scraping. Obfuscation can obstruct content scraping, deterring theft of your original content. It also helps block malicious bots looking to carry out attacks.
To reduce text copying. By making text harder to interpret at first glance, obfuscation can deter visitors from simply copying and repurposing your unique content.
To selectively show information. Obfuscation allows information to be revealed only to human visitors, while remaining obscured to bots.

There are a variety of common obfuscation techniques used:

Encoding Emails and Text

One easy obfuscation method is to encode or encrypt emails, phone numbers, and other text into formats that are unreadable by bots but can be decoded by humans.

For example, you could use ROT13 to shift alphabetical characters 13 places. So [email protected] becomes [email protected] – gibberish to bots but decipherable for users.

Other text encoding options include hex encoding, base64 encoding, and hash functions. Online encoders make it simple to convert strings both ways.

Inserting Null or Junk Text

You can inject random characters or “null” text into sensitive strings to break them up. For example:

test becomes te****st

When coupled with CSS to hide the junk text, it appears normal to users but scrambled to bots.

Reversing Strings

Flipping text backward is an easy obfuscation.

[email protected] reversed becomes moc.liame@elpmaxe.

CSS can then flip it back for users. Bots see only the reversed string.

Using CSS Tricks

CSS gives lots of options for text obfuscation. You can rotate, mirror, animate, hide, overlay, and more to strings.

For example, setting unicode-bidi: bidi-override; direction: rtl; will reverse text. Hidden junk text can be inserted but made invisible with display: none;.

JavaScript Decoding

JavaScript gives even more control over obfuscation. You can encode strings in any number of ways, and write scripts to decode them client-side.

For example, you could base64 encode an email, and use JavaScript to decode and display it as a mailto link.

Image and CAPTCHA Obfuscation

For the most robust obfuscation, text can be shown only as an image or after a CAPTCHA challenge.

This ensures only humans can read the information, but creates accessibility and usability hurdles.

Obfuscation gives useful options to balance security and usability. The right techniques allow selectively revealing content only to real visitors.

Obfuscating Email Addresses

Email addresses are prime targets for scraping bots and spammers. Displaying your contact information publicly often leads to headaches dealing with floods of unwanted messages.
Obfuscating email addresses makes them more difficult for harvesters to gather, while still allowing human visitors to interpret them. However, it does come with some challenges.

Why Obfuscate Email Addresses?

There are a few key reasons why obfuscating emails on your site is recommended:

Prevent automated scraping. Obfuscation foils basic email scrapers, reducing the amount of address harvesting.
Reduce direct spam. Your published email addresses are much less likely to end up on spam lists and receive junk mail.
Improve deliverability. Obfuscated addresses are less likely to trigger spam filters when used to send emails.
Deter phishing attempts. Making emails harder to exploit makes successful phishing and social engineering less probable.
Discourage text copying. Obfuscated emails can’t be easily copied/pasted, deterring content theft.

Key Challenges with Email Obfuscation

While obfuscation is useful, it introduces some challenges:

Accessibility issues. Some techniques like CSS and JavaScript break when disabled.
Usability problems. Users often must manually type out obfuscated addresses instead of clicking links.
Security limitations. Determined spammers can still find ways around many obfuscation methods.
Maintenance needs. Obfuscated content needs testing to ensure it doesn’t break.

Reversing Email Address Text

One reliable method is writing the email backward, then flipping it with CSS:

<span class="flip">moc.liamg@elpmas</span>

.flip { direction: rtl; }

This fully hides the address from scrapers. The downside is it prevents clickable mailto links.

Inserting Null Text with CSS Hiding

Adding fake text inside the email address obscures it from bots:

<span class="obfuscate">name@<span class="null">fake</span>site.com</span>

.null { display: none; }

With the null text hidden by CSS, humans see the email as normal.

Encoding with JavaScript Decoding

Encoding the email, then dynamically decoding it client-side is effective:

<script>
  encoded = "..." // encoded email
  document.write("<a href='mailto:" + decode(encoded) + "'>Email</a>");
</script>

This allows clickable obfuscated mailto links. But it requires JavaScript.

There are pros and cons to each approach. Multi-layered obfuscation combines methods for the best protection. The ideal solution depends on your priorities and visitors.

Obfuscating Text Content

In addition to obscuring contact information, obfuscation techniques can also be applied to other sensitive text content on a page. The goals are similar – preventing automated scraping, deterring theft, and blocking malicious bots.

Obfuscating Text to Block Web Scraping

Web scrapers target and extract text content from sites. By obfuscating key text, scraping bots are unable to properly read and replicate that content. Some examples:

Encoding specific paragraphs of text that need protection.
Using CSS to overlay web scraped content with images or animations.
Implementing text rotation or animation that can’t be scraped.

This protects content integrity and prevents content theft.

Encoding and Decoding Text Strings

Text strings can be encoded/encrypted in many ways:

Hexadecimal or base64 encoding
Hashing algorithms like MD5
Cipher algorithms such as ROT13

JavaScript can then be used to decode those strings and display the original text to human visitors.

For example:

<script>
  encoded = "..." 
  document.write(decode(encoded)); 
</script>

Using CSS and JavaScript Tricks

We can also leverage CSS and JavaScript to manipulate text in ways that obstruct scraping:

Splitting text across multiple elements
Inserting and hiding junk text
Animating or randomly positioning words
Reversing, rotating or transforming text

These tricks make it extremely difficult for bots to scrape coherent content.

Accessibility Considerations

When obfuscating text, it’s important to ensure usability and accessibility for all visitors.

Don’t obscure all content – apply selectively only where needed.
Use multiple layers of obfuscation for redundancy.
Clearly signify decoded or reversed text (e.g. icons).
Allow decoding to be disabled or provide alternate accessible content.

With some forethought, text obfuscation can effectively block scrapers without harming usability.

Obfuscating URLs and Links

In addition to blocking email and text scraping, obfuscation can also be applied to URLs and links. There are a few common reasons and methods for obscuring URLs.

Why Obfuscate URLs?

URLs may need obfuscation for:

Hiding internal site structure from scrapers
Preventing direct access to resources like assets
Blocking embedded links to unauthorized content
Protecting sensitive user info in query parameters
Confusing harmful bots targeting page URLs

Overall it helps hide details about your site and disrupt malicious bots.

URL Shortening vs. Obfuscation

URL shortening services like Bitly condense long URLs into short redirects. This saves characters, but the URL remains visible.

Obfuscation transforms the URL into an encoded or encrypted string that conceals the actual address.

Shortening is more for convenience, while obfuscation is for security.

Encoding URLs with ROT13

ROT13 encoding shifts alphabetical characters by 13 places.

For example, example.com/path becomes rknzcyr.pbz/cneg.

JavaScript can decode the obfuscated URL for users.

JavaScript URL Decoding

We can fully hide original URLs like this:

<a href="decode.js?encoded=...">Link</a>

// decode.js
let url = decode(getParam("encoded")); 
window.location.href = url;

The URL is encrypted and passed via a parameter. JavaScript decodes and redirects.

Building Obfuscated Links

For user-friendly obfuscated links:

Use URI encoding for param values
Redirect via intermediate pages
Layer multiple encoding/encryption
Validate web app side to allow access

The goal is achieving a balance between security and usability for URLs.

Obfuscation Best Practices

Obfuscation can be a useful security tactic, but it also introduces challenges around usability and accessibility. Some best practices help balance its pros and cons.

Balancing Security, Usability and Accessibility

When applying obfuscation, aim to strike an ideal balance:

Use the minimum level of obfuscation needed to achieve goals.
Test that obfuscated content decodes properly under various conditions.
Allow users to opt out of decoding if needed.
Provide accessible alternatives to obscured content when feasible.
Clearly indicate obscured vs original content (icons, color coding).
Apply selectively to protect only sensitive information. Avoid obfuscating all content.

Taking these steps helps ensure a positive experience for users.

When to Avoid Obfuscation

There are some cases where obfuscation may be unnecessary or problematic:

On high-traffic public sites, email harvesting is often inevitable.
For public info like business addresses, obfuscation just reduces usability.
When required to provide accessible, indexable content by law.
If harmful bots are detected and blocked via other means already.
For sites with tech-savvy users who desire direct access to content.

Consider your specific circumstances and goals before implementing obfuscation.

Testing Obfuscated Content

Be sure to thoroughly test obfuscated content under different conditions:

With JavaScript enabled vs disabled.
With CSS enabled vs disabled.
On mobile, tablet, desktop devices.
Across multiple browsers and versions.
After site changes that may impact decoding.

This helps identify any issues earlier. Consider automated testing tools that simulate user conditions.

Considering Alternate Tactics

Obfuscation may not make sense depending on your priorities and tolerance for potential downsides. Some alternatives to consider:

Allowing access to content, but tracking/blocking scrapers specifically.
Using a contact form for emails instead of published addresses.
Reconsidering whether content needs to be publicly visible at all.
Applying IP-based access controls for sensitive content.
Implementing a site membership with gated content.

Weigh all options to find the optimal approach for your needs.

Powerful Obfuscation Tools and Services

Implementing robust obfuscation manually can be tricky. Fortunately, there are various handy tools and services to help.

Managed Obfuscation Services

For a fully managed solution, cloud services like:

Cryptr – APIs for encryption, decryption, and key management.
Microsoft Azure App Protection – Service for obfuscating apps and data.
Obfuscapk – Tool and service for obfuscating Android APK code.

These provide robust protection without needing to code the obfuscation yourself.

WordPress Obfuscation Plugins

For integrating obfuscation into WordPress sites, some top plugins include:

WP Hide & Security Enhancer – All-in-one obfuscation and security.
SL CAPTCHA – Implements secure CAPTCHA forms.
Email Encoder – Specifically for obfuscating emails.

These make it easy to add obfuscation on WordPress sites with just a few clicks.

The right tools can save huge amounts of development time and provide reliable obfuscation. Evaluate them to find one tailored to your specific needs.

Key Takeaways on Obfuscating Emails, Text and More

Obfuscation can be a useful technique for security, but needs to be applied carefully. Here are some key takeaways:

Obfuscation makes email addresses, text and URLs harder for bots to scrape while still legible to humans. It’s not perfect but helps reduce scraping.
Common methods include encoding text, injecting junk strings, CSS tricks, and JavaScript decoding. Each has pros and cons to weigh.
When obfuscating emails, provide clickable mailto links for usability. But this can reduce obfuscation strength.
Obfuscation introduces potential usability, accessibility and maintenance challenges to consider. Test obfuscated content thoroughly.
For emails, using contact forms instead of published addresses is more robust. But this reduces convenience for users.
For public sites, the increase in security from obfuscation may not outweigh reduced usability. Evaluate your specific goals.
Automated tools and services can quickly implement obfuscation without needing to code complex solutions yourself.
Balancing security, spam reduction and user experience is key when applying obfuscation. Avoid over-obfuscating content.
Consider all options and use the minimal level of obfuscation suited to your purposes. There is no one-size-fits-all solution.

Frequently Asked Questions Here are some common questions about obfuscating emails, text and other content:

What are the main benefits of obfuscation?
The main benefits are preventing automated scraping, reducing spam, protecting sensitive information, and deterring content theft.

What are some downsides of obfuscation?

Potential downsides include reduced accessibility, poorer user experience, increased maintenance work, and limitations in fully stopping determined bots.

When should I avoid obfuscation?

Avoid obfuscation if you have an extremely high-traffic public site, need to provide accessible content by law, or already block malicious bots through other means.

What is the best method for obfuscating email addresses?

Some top email obfuscation methods are reversing the address text, inserting hidden null text, and encoding with client-side JavaScript decoding.

How can I obfuscate text content?

Effective options for text obfuscation include selective encoding, CSS manipulation like hidden text, and carefully timed animations or text scattering.

Is URL shortening the same as URL obfuscation?

URL shortening just shortens a link while URL obfuscation transforms the URL into an encrypted/encoded string to hide the actual address.

How do I make obfuscated content accessible?

To make obscured content more accessible, allow opt-out of decoding, provide plaintext alternatives, and clearly convey the original source of encoded content.

What should I test with obfuscated content?

Thoroughly test obfuscated content with JavaScript on/off, CSS on/off, on all device types, different browsers, and after site changes.

How can I balance security and usability with obfuscation?

Use the minimum required level of obfuscation, apply selectively, provide user options, implement accessible alternatives, and clearly indicate obscured content.