Spam, whatcha gonna do?

I didn’t have my email address up on the blog from the start, this was for a reason. Spam is a major problem for all users and webmasters especially are exposed to this, as they will by and large wish to be contactable, and so have to make their email address available in some format for their users.

How can you defend yourself against spammers?

Check bottom of this page now to see the solution I picked!



I did some research on it these past few days to look through the most common methods of displaying your email address and determining which one would be best, in terms of both protecting my email address from email harvesting spammer scum while at the same time making it user-friendly.

Common methods used by webmasters for displaying their email address

1. Encode your email address by using character entities

   In this method you substitute ASCII codes for the alphanumeric characters of your email address in the html of your page. The advantage of this method is that your email will still be clickable and visible to the end user normally, but the less sophisticated email harvesting programs won’t sniff out your email address.There is an automatic encoder and further information available at http://www.wbwip.com/wbw/emailencoder.html . This email page however was last updated in 2006, so I’m inclined to think that nowadays most email harvesting programs would still be able to detect your email address.

2. Display your email address in a non-email format

   A simple method often used by sites is to have your email address displayed something like username at mydomain dot com. Again this method makes it more difficult for harvesting programs. I would still think that a sophisticated harvesting program could parse this to determine the real email address. There are a few disadvantages of this method however, one is that a user can no longer simply click on the email address and also the less Internet savvy user might have difficulty in reconfiguring it to the correct email address, it also allows for the possibility of human error, even from an experienced Internet user.

3. Should you use web forms?

   Web forms are very commonly used amongst many of the bigger sites. In fact you often see them used in many of the online poker room sites to allow a user to submit a support request. The main advantage of this method from the point of view of the more regular webmaster is that it makes harvesting your email address very difficult if not impossible. The one downside to this that I see is that if you genuinely want people to be able to contact you easier, it’s a bit more cumbersome as people have to submit their details in the web form and as such may put off many potential useful contacts from getting in touch with you.

4. Script it!

   You can build server side scripts in different formats like php, asp.net or using javascript. The advantage of using scripting is the email address can be broken up into different parts but it appears usable to your user. Disadvantages are that it’s still not 100% foolproof method and also if you use javascript to build the mailto link then in order for this to work, your user needs to have javascript enabled in their browser.

5. Picture your email address

   Instead of using text to display your email address, you can create an image of your email address. Now email harvesting software will have a much more difficult time in sniffing out your email address, the harvesting software would require optical character recognition capabilities in order to sniff out the email address. The downside to this method is that the user would be required to physically type in the email address and it also increases the chance for human error. Alternatively you could make the image clickable and link it to say a web form or javascript, but doing this of course would expose you to the disadvantages associated with these methods.

The solution is recaptcha!

So after scouring the Internet for information on the best way to protect my email address from email harvesting scum I still wasn’t 100% sure which method would be the best. I was sort of split between scripting the mail address and using an image. Then I thought about it a bit more laterally. I decided to take a look at how someone like James Thornton actually made his own email address available. He’s using a service from http://recaptcha.net/where a user has to manually enter two words which are easily readable by humans but cannot be read by spamming programs.

Avoid junking genuine emails

Well it seems like a very good way of doing it to me, it does involve a small bit of work (about 10 seconds) for the user to get your email address, but I figure if someone is genuinely interested in making contact it’s hardly a big deal. There are a few benefits to this, hopefully it should mean the amount of spam I get will be very low and the side benefit of this is if someone is sending me a genuine email it lessens the chance that I might mistakenly dismiss it as spam.

For further information check out the following resources

http://www.windowsecurity.com/whitepapers/Email_Harvesting_Techniques_FAQ.html Techniques used by email harvesting programs.

http://kb.iu.edu/data/alcm.html Indiana University’s very useful information on methods of protecting your email address.

http://jamesthornton.com/software/redirect-mailto.htmlInternet Business Consultant James Thornton’s information on how to use mailto smartly.

http://www.monkeys.com/wpoison/Wpoison – an interesting looking tool that makes the job of email harvesting scum more difficult.