# Ensure Email Obfuscation is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787220713233-ensure-email-obfuscation-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Email Address Obfuscation is turned on, so that Cloudflare hides email addresses on your web pages from bots and scrapers, while keeping them visible and clickable for human visitors.

**Rationale**

Email addresses published on websites are collected by bots and added to spam and phishing lists. Email Address Obfuscation encodes addresses in the page so that most automated scrapers cannot read them, reducing spam and targeted phishing against your staff.

**Impact**

-   Hides email addresses from most scrapers
    
-   Reduces spam and phishing against published addresses
    
-   Addresses stay visible to human visitors, but some crawlers may see an obfuscation link instead
    

**Default Value**

Cloudflare enables Email Address Obfuscation automatically when a zone is added, but it can be turned off.

**Pre-Requisites**

-   Cloudflare account with Administrator or Super Administrator role for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Check the Email Address Obfuscation setting and verify that it is On.
    
5.  If it is not On, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Set Email Address Obfuscation to On.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Set Email Address Obfuscation back to its previous value.
    

**Reference**

-   [https://developers.cloudflare.com/waf/tools/scrape-shield/email-address-obfuscation/](https://developers.cloudflare.com/waf/tools/scrape-shield/email-address-obfuscation/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.