Product support

Visit this product's website for support.

  • Added on Jun 16, 2022
  • Current version: 2.1.2
  • Platform Compatibility
    v3.x use latest
    v2.x use latest
    v1.x use latest
  • Created by
  • Public repository


Obfuscation Plugin

Obfuscate emails and phone numbers for spammers, but not for your human visitors.

How to Use it

Simply add the respective component onto your page and in specify the email address or phone number in the component's settings. The plugin will then automatically present bots with obfuscated data, but humans receive a nicely formatted link.

Why Should I Bother

Spammers try to crawl to internet for email addresses to send spam to. This is why you sometimes see emails written like 'mail(at)example.com'. This improves your resilience against spammers, but it is also annoying for regular, human users. This plugin solves this problem, by transforming to human readable and even linked formats as soon as we are reasonably sure that a visitor is human.


This plugin was partly inspired by SpamSpan.


All parts of this software are licensed under LGPL 3.0 or any later version (SPDX license indicator: LGPL-3.0-or-later). See the license files in the source code for details.

Copyright 2022 Michael Heider



The plugin features two components, one for email addresses and one for phone numbers.



  • Display Text: If given, display this text instead of the unobfuscated email / phone. Make sure this does not contain your email/phone, as it is not obfuscated!
  • E-Mail address / Phone number: Your email / phone in usual format (no obfuscation).

Mail Component

Additional configuration:

  • Subject: Default subject when the link is opened in an email program.
  • Body: Default body when the link is opened in an email program.

Phone Component

The displayed phone number (assuming no display text is provided) is equal to what was entered in the component's config. This means you can use your own phone number format. The phone number in the href has all non numeric characters removed, except a leading '+' if present.

How it Works

The obfuscation is JavaScript based. This means that the HTML code contains only an obfuscated version of the data, but as soon as the document and the script are loaded it is immediately changed into a perfectly normal, human readable format.

What about Users with JavaScript disabled

The obfuscation is designed so that even without the transformation, the data is still human readable, although slightly obfuscated. Also, it does not feature a link. If you want to see exactly what it looks like you can either temporarily disable injecting of the obfuscation script in the plugin's settings or disable JavaScript in your browser.

How Good is the Obfuscation

No obfuscation is perfect. Given a good enough bot or one that is tailored to exactly this format, you can still scrape the email addresses or phone numbers. However, it already requires more effort. Furthermore, spammers could also execute the JavaScript before searching email addresses, but this incurs a higher load on the spammers' systems.


Minor improvements.

Jun 19, 2022


Public release. Internal changes.

Jun 16, 2022


Update phone regex to support more international formats. Slightly change obfuscated layouts. Bug fixes in human readable phone number cleaning.

Jun 16, 2022


Change license. Replace modified SpamSpan with completely custom implementation.

Jun 16, 2022


Fix wrong license included.

Jun 16, 2022


Add composer.json for compatibility with OctoberCMS 2.

Jun 16, 2022



Jun 16, 2022


Phone component.

Jun 16, 2022


Renamed mail component to email.

Jun 16, 2022


E-Mail component working, updated SpamSpan.

Jun 16, 2022


Initialize plugin.

Jun 16, 2022