Our nonprofit had a rebranding and domain migration. Within 2 weeks of setting up our nonprofit’s new website at future-matters.org (with Scrape Shield enabled), with new-domain team emails, I started getting all the same spam I get at my other (private) email addresses.
Support at my excellent hosting provider Rocket.net (using Cloudflare Enterprise) confirmed:
We have used scrape shield in the past and we didn’t see a difference with it on vs off. Bots can still scrape somehow or they just guess the email combination based on other information or other places emails are listed.
We do need to publish at least one address - while avoiding scraping - preferably one per team member. Obfuscation will be needed. I have looked through the great review at Email obfuscation: What works in 2024?. What is a way to get it to work?
And is this a cat and mouse game that will just continue to be frustrating, with no sufficient “solution” ever reached?
Appreciate any advice on how to safely get our emails on our site for clients to reach us.
Email obfuscation by Cloudflare is designed to protect your email addresses from being harvested by bots when displayed on your website. To ensure it’s working, you can check your website’s source code; the email address should appear obfuscated there. However, sophisticated bots may still bypass this, and if your email is listed elsewhere online, it could be scraped from there.
To safely display emails on your site, consider these steps:
Use Cloudflare’s Email Address Obfuscation feature and verify it’s active by checking the page source.
Implement additional methods like using contact forms, displaying emails as images, or using JavaScript to dynamically generate email links.
Regularly change published email addresses and use different ones for public-facing communications.
Remember, it can be a continuous challenge to stay ahead of spammers, so combining multiple strategies is often the best approach.
I hope this helps. Please let us know if you have other questions.