Type your email address into a search engine, inside quotation marks. If it shows up on a forum post from years ago, an old CV, a club's member list or the contact page of a side project, it has almost certainly been collected by automated scrapers too. Those programs crawl the web looking for anything shaped like name@domain, and the lists they build are sold, swapped and mailed for years.
The short answer to how to hide email from spam bots: publish your main address as little as possible, put a contact form in front of any address on your own website, give public places an address you can filter or replace, and use a short-term inbox for one-time sign-ups. None of this makes an address invisible. Once a human can read it, a determined program can usually read it too. What these steps do is cut the number of lists your address ends up on, and keep the damage limited to an address you can afford to lose.
How scrapers and spam bots find email addresses
Most harvesting is cheap and automatic. A bot downloads pages, runs a pattern match for the @ sign followed by a domain, and stores whatever matches. Other addresses come from sources that need no crawling at all. Knowing which source exposed you tells you which fix will help.
| Source | How the address gets there | What you can do |
|---|---|---|
| Your own website | A mailto: link or an address in the footer or contact page | Use a contact form, or a role address you can filter |
| Forums, comments and reviews | Signatures, "email me at" replies, public profile fields | Edit old posts, hide the profile field, use a separate address |
| Domain registration records | Contact details in WHOIS or RDAP data for a domain you own | Check your registrar's privacy setting |
| Public profiles and code | Social bios, author pages, Git commit metadata | Remove the address, use a no-reply commit address |
| Documents | PDFs, CVs, slides and spreadsheets posted online | Remove or replace files you control |
| Data breaches | A service you used lost its user database | Nothing on your side prevents it, so limit which address each service gets |
| Guessing | Common names like info@ or anna@ tried at known domains | Filtering, and rejecting unknown recipients on your own domain |
Domain records deserve a note because many people assume they are still fully public. Since the GDPR took effect in 2018, most large registrars hide personal contact details in public WHOIS results, and many offer a free privacy service. The rules still vary by registrar and by country-code domain, and organizations are often shown in full. Look up your own domain once to see what is actually displayed.
Breaches are the source people underestimate. You can be careful everywhere and still end up on spam lists because a shop, forum or app you used years ago was hacked. That is why the advice further down focuses on which address you hand out, not only on where you publish it.
Protecting an address on your own website
If you run a site, blog or online shop, the contact page is the most likely place for bots to find you. You have more control here than anywhere else, so it is worth doing properly.
Use a contact form instead of a mailto link
A form sends the message from your server, so the receiving address never appears in the page. Validate input on the server, not only in the browser, and send the message to an address that is not printed anywhere. Forms attract their own spam, which is the problem the next sections handle, but a form spammer cannot add your address to a list that gets resold.
Obfuscation: what each trick really stops
If you must show an address, there are ways to make it harder to harvest. They differ a lot in how much they help, and each has a cost for real visitors.
| Method | Stops | Does not stop | Cost |
|---|---|---|---|
| Writing "name at domain dot com" | The simplest pattern-matching bots | Scrapers that look for common spellings of "at" and "dot" | Visitors must retype the address |
| HTML character entities | Bots that read raw source without decoding | Any parser that decodes HTML, which most do | Almost none |
| Building the address with JavaScript | Crawlers that do not run scripts | Headless browsers that render the page like a person would | Breaks for visitors with scripts blocked |
| Showing the address as an image | Text-based scrapers | Text recognition, which is cheap and accurate | Screen readers cannot read it, and nobody can copy it |
| A CDN's obfuscation feature | Many common scrapers, with no work on your side | Bots that execute the decoding script | Depends on the provider's script |
The honest summary: obfuscation filters out the laziest bots, and a lot of harvesting is lazy, so it reduces volume. It does not protect an address against anyone who targets your site on purpose. Treat any address you display as one that will eventually be collected, and choose it with that in mind.
CAPTCHA, honeypots and rate limits
These protect the form, not the address. A CAPTCHA or a challenge service blocks many automated submissions, though some get through and every challenge annoys real people a little. A honeypot is a hidden field that people never see and bots fill in, so you can quietly discard those submissions. Rate limiting by IP address stops one source from sending hundreds of messages in a minute. Used together, they keep your inbox usable without asking visitors for much. If your form adds people to a mailing list, use double opt-in so nobody can subscribe a stranger's address.
Keep your main address off public pages
Your main address is the one tied to your bank, government services, work and the people you know. The best protection for it is simple: it should not appear anywhere a crawler can reach. Go through the usual places once:
- Social and professional profiles. Remove the address from bios, and set the contact field to visible only to connections where the platform allows it.
- Forums and old accounts. Edit signatures and old posts that contain it. Close accounts you no longer use.
- Code repositories. GitHub and similar platforms let you use a private no-reply address for commits. New commits stop showing your real one, but old commits keep what they recorded.
- Documents. A CV or brochure posted as a PDF is plain text to a crawler. Replace files you control with versions that use a contact form or a separate address.
- Directories and member lists. Ask clubs, schools and associations to remove the address or limit the list to members.
Removing an address does not remove it from lists that already exist, and search engine caches and web archives may keep copies for a while. It does stop new scrapers from picking it up, which matters over time.
Give public places a separate address
Some addresses have to be public: a freelancer's contact address, a seller's support address, an address printed on a flyer. The fix is to make that address different from your private one. A role address like contact@yourdomain.example, or a second mailbox at a free provider, can be filtered hard and replaced if it gets out of hand, without touching your bank or your friends.
For sign-ups, an email alias goes further. Alias services give you a separate forwarding address for each site, so the site never sees your real one and you can switch off any alias that starts receiving junk. Examples include Apple's Hide My Email for iCloud+ subscribers, Firefox Relay, SimpleLogin and DuckDuckGo Email Protection. Plus addressing, such as yourname+shop@gmail.com, is useful for tracing where spam came from, but it does not hide anything, since anyone can delete the tag. We compare these options in our guide to temp mail versus email aliases, and our article on building a personal email strategy shows how to split addresses by level of trust.
| Option | Hides your real address | How long it lasts | Best for |
|---|---|---|---|
| Main address | No | Years | Bank, work, government, people you know |
| Plus address | No | As long as your mailbox | Tracing which site leaked or sold it |
| Secondary mailbox or role address | Yes, if nothing links it to you | Years | Public contact details, shops you return to |
| Email alias | Yes | Until you switch it off | Accounts you keep but do not fully trust |
| Temporary inbox | Yes | About 24 hours | One-time sign-ups and downloads |
Use a temporary inbox for one-time sign-ups
A large share of spam starts with a single sign-up you never needed again: a free guide, a forum thread you wanted to read once, a Wi-Fi portal, a test account. For these, a temp mail address keeps your real one out of the site's database completely. If that site is later breached or sells its list, the spam goes to an address that no longer exists.
VookMail works without an account. Open the site and an address is already there. Copy it with the Copy button, or press New to choose your own username and one of more than 30 domains. The inbox checks for mail every few seconds, so a confirmation link appears without reloading. When you are done, Delete removes the address. Otherwise, messages are deleted within about 24 hours. If you want the details of how this kind of throwaway email address works, that page covers it.
The limits are part of using it well. A temporary inbox opens only in the browser that created it, and its messages are not end-to-end encrypted, so it is not a place for anything personal. Never use one for an account you need to keep, because password resets will have nowhere to go. Some sites do not accept disposable addresses, which is their decision, and in that case an alias or secondary address is the right choice. A temporary address must not be used to claim repeat free trials or offers meant for one person, and our terms and conditions forbid that use. Our guide to signing up without your real email goes through which situations fit.
Check whether your address is already exposed
Have I Been Pwned is a long-running free service that tells you whether an address appears in known breach data. A result shows which services lost it and roughly what else was taken, such as passwords or phone numbers. If a password was included, change it everywhere you used it and turn on two-factor authentication. Our guide on what to do after a data breach covers this step by step.
Be careful with unfamiliar "check if your email was leaked" sites. Typing your address into an unknown form is one more way to hand it to a list. Stick to services with a long public track record, or the breach alerts built into your password manager or browser.
What to do if your address has already been scraped
There is no way to pull an address back off lists that already have it. You can make those lists less useful and stop new ones from forming.
- Do not reply or click. Replying, even to say stop, confirms a real person reads the address. Do not click links in mail from senders you do not recognize.
- Report spam instead of deleting it. Reports train your provider's filter, which sees the same campaign across millions of mailboxes.
- Remove the address from the places you found. Use the search from the start of this article, and fix what you control.
- Replace a public address on your site with a form, or with a new role address, and keep filtering the old one for a while.
- Turn off automatic image loading for unknown senders, so tracking pixels cannot confirm the address is active. Our article on email tracking pixels explains how they work.
- Move future sign-ups to aliases or temporary addresses, so the main address stops spreading.
- Change your main address only as a last resort. If you do, keep the old one with forwarding for several months and move important accounts first.
For the inbox side of the problem, including filters and safe unsubscribing, see our guide on how to stop spam emails.
Myths worth dropping
- "Spam bots cannot read images." Text recognition is cheap. An image slows down simple scrapers and makes life harder for screen reader users.
- "JavaScript hides my address completely." Many scrapers now run full browsers. Scripts filter out older bots, not all of them.
- "If I never post my address, I will never get spam." Breaches and guessing reach addresses that were never published.
- "Unsubscribing from spam removes me from the list." With legitimate senders it usually works. With true spammers, a click can confirm your address is active.
Questions people ask
Can spam bots read an email address shown as an image?
Some can. Text recognition tools read clear images easily, and they are cheap to run. An image stops basic text scrapers, but it is inaccessible to screen readers and cannot be copied, so a contact form is usually the better choice.
Is writing "name at domain dot com" still worth it?
It helps a little against the simplest bots and costs visitors some effort. It should not be your only protection for an address you care about.
Does WHOIS privacy stop all spam to my domain?
No. It keeps your personal details out of public domain lookups, which removes one source. Role addresses like info@ still receive guessed spam, and anything on your website can still be scraped.
Will a temporary email protect my main address?
For one-time sign-ups, yes, because the site never receives your main address. It does not help with addresses that are already exposed, and it is not suitable for accounts you need to keep.
Can I get my address removed from spam lists?
Not from lists run by spammers. Legitimate senders will remove you if you unsubscribe, and some data brokers offer opt-out forms. For the rest, reporting and filtering are the realistic tools. More guides are on the VookMail blog.