Description

Ensure Email Address Obfuscation is turned on, so that Cloudflare hides email addresses on your web pages from bots and scrapers, while keeping them visible and clickable for human visitors.

Rationale

Email addresses published on websites are collected by bots and added to spam and phishing lists. Email Address Obfuscation encodes addresses in the page so that most automated scrapers cannot read them, reducing spam and targeted phishing against your staff.

Impact

  • Hides email addresses from most scrapers

  • Reduces spam and phishing against published addresses

  • Addresses stay visible to human visitors, but some crawlers may see an obfuscation link instead

Default Value

Cloudflare enables Email Address Obfuscation automatically when a zone is added, but it can be turned off.

Pre-Requisites

  • Cloudflare account with Administrator or Super Administrator role for the zone

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Check the Email Address Obfuscation setting and verify that it is On.

  5. If it is not On, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Set Email Address Obfuscation to On.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Set Email Address Obfuscation back to its previous value.

Reference