No email in plain text
If an email address is written in plain text in the HTML code, automated bots harvest it and add it to spam lists. This check detects whethe…
Analyse my site for freeUnderstanding "No email in plain text"
Publishing an email address in plain text in a page's HTML code (contact@yoursite.com visible directly in the source) is the simplest, but also the most exploited, target for an email scraper — a bot that crawls the web looking for @domain.tld patterns to build mailing lists sold to spammers.
The issue isn't having a contact address — that's essential — but exposing it in plain, unprotected text rather than through a form or an obfuscation method that remains readable by a human but unreadable by a simple bot.
How TheSiteFuse checks "No email in plain text"
TheSiteFuse searches the page's HTML code for any pattern matching an email address (standard user@domain.tld regular expression). Addresses appearing only inside an href="mailto:..." attribute are excluded from the count — a mailto link is a legitimate, deliberate practice, different from plain displayed text. Image-filename false positives (e.g. photo@2x.png) are also filtered out. If plain-text email addresses are still detected, the check returns a warning with a partially masked preview (e.g. con***@yoursite.com).
Why "No email in plain text" matters
- Massive spam — an address collected by a scraper typically ends up in dozens of resold lists, generating an influx of spam that's nearly impossible to stop afterward.
- Targeted phishing vector — knowing the exact email address of a contact (often paired with a nearby displayed name) allows crafting personalised, more credible phishing emails.
- Credential-stuffing attacks — an exposed professional email address is also a starting point for testing passwords leaked in other data breaches (see the "Brute force / rate limiting protection" check).
Fix "No email in plain text" step by step
Recommended solution — contact form
Replace the direct display of the address with a form that sends the message server-side, without ever exposing the real address to the browser. This is the most robust and visitor-friendly protection.
If an address must remain visible
<!-- Mailto link: legitimate, but still readable by advanced scrapers -->
<a href="mailto:contact@yoursite.com">Contact us</a>
<!-- Simple HTML entity obfuscation (deters basic scrapers) -->
<script>
document.write('contact' + '@' + 'yoursite.com');
</script>
Limitation to be aware of: no client-side obfuscation is foolproof against a sufficiently sophisticated scraper (including JS execution). A contact form remains the only solution that fully eliminates the risk.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — No email in plain textDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.