If you publish a contact address in plain text, it will be scraped — that's settled. The measures that still work are a contact form instead of an address, rendering the address as an image or via script, and putting it behind a challenge. The measures that stopped working around 2005 are text obfuscation like "name [at] example [dot] com". The most robust answer is to publish an alias you're willing to replace.
What actually works
A contact form
No address on the page at all. Most effective single option, and it costs you some legitimate contacts — people distrust forms, and some won't use one. Whether that trade is worth it depends on how much you need to be easily reachable.
Rendering the address as an image
Defeats basic text scraping. Defeated in turn by OCR, which is cheap now, so treat it as friction rather than protection. It's also poor for accessibility, since screen readers can't read it — a real cost.
Assembling the address in JavaScript
The address never appears in the served HTML; it's constructed client-side. This stops harvesters that don't execute JavaScript, which is still many of them. Sophisticated ones render pages fully and get it anyway.
Reasonable middle ground: meaningfully reduces volume, keeps the address clickable, and degrades gracefully if you also provide a form.
A challenge before revealing it
"Click to show email" behind a simple interaction. Stops most automated collection and adds one click for humans.
What doesn't work
name [at] example [dot] com, name AT example DOT com, and every variation of it. These were mildly effective two decades ago. Harvesters have parsed them for years — the patterns are trivial to match and there are only a handful of them.
What they reliably achieve is inconveniencing humans, who now have to reassemble your address by hand and sometimes get it wrong. You pay the cost and get nothing.
Similarly ineffective: reversing the text with CSS, splitting it across HTML elements, and inserting hidden characters. All are defeated by rendering the page and reading the result, which is what a modern crawler does anyway.
The approach that survives being scraped
Accept that anything published will be collected, and make that survivable rather than trying to prevent it.
Publish an alias created for the purpose — contact@yourdomain.com or hello2026@yourdomain.com. It will be harvested. When the volume becomes unmanageable, switch it off and publish a replacement. Nothing else you own is affected, and you know precisely why it happened.
This turns a permanent exposure into a renewable one. It's the only strategy that doesn't degrade over time, because it doesn't depend on outsmarting anyone. The general principle
The places people forget
Your website is usually the address you thought about. These are the ones you didn't:
- Commit metadata in public repositories.
- WHOIS records for your domain, if privacy protection is off. Fix
- PDFs you've published — newsletters, reports, minutes.
- Old pages still live on a subdomain or a previous version of the site.
- Third-party listings — directories, association pages, conference bios you don't control.
Worth auditing once: search your address in quotes and see where it surfaces. Getting it out of search results
More: protecting your address generally · how harvested addresses end up with brokers