Plaintext email addresses on a website are a security and spam risk. Spam bots scan pages for email addresses and add them to spam lists. If your email is visible in plain text, you will receive more spam. In this guide, you will learn how to check for plaintext emails, why they matter, and how to protect them.
What is a plaintext email
A plaintext email is an email address written in plain text in the HTML code or visible on the page:
contact@example.com
When an email is in plaintext, it can be:
— read by spam bots that scan websites;
— copied by anyone who visits the page;
— harvested by automated tools for spam campaigns.
Check for plaintext emails via the plaintext email checker.
Why plaintext emails are a problem
Three reasons.
1. Spam. Spam bots scan millions of pages daily, collecting email addresses. Once your email is in a database, it will receive spam.
2. Phishing. Attackers can use your email for phishing campaigns, pretending to be you.
3. Privacy. Plaintext emails expose your contact information to anyone who visits the page.
For business sites, plaintext emails are a common source of spam and phishing attacks.
How to check for plaintext emails
Three ways.
Method 1. Plaintext email checker tool
The fastest way is to use an online checker. The SerpMax plaintext email checker tests any URL and shows:
— all plaintext email addresses on the page;
— where they appear (visible text, HTML code, meta tags);
— whether they are protected (obfuscated, image, contact form);
— recommendations for protection.
The tool works with any website.
Method 2. View page source
Open the page, right-click, and select "View page source". Search for @. Any email addresses found in the HTML are plaintext.
Also search for mailto: — this is a link that opens the email client. If the email is in the mailto link, it is plaintext.
Method 3. Chrome DevTools
Open Chrome DevTools (F12). In the Elements tab, search for @. Check if any email addresses are visible in the HTML.
Common places where plaintext emails appear
Five common locations.
1. Contact page
The most common location. Contact pages often list email addresses in plain text.
How to fix: use a contact form instead of a plaintext email. Or obfuscate the email.
2. Footer
Many sites list contact emails in the footer. This is visible on every page.
How to fix: link to the contact page instead of listing the email directly.
3. About page
About pages often include team emails or company contact information.
How to fix: use a form or obfuscate the emails.
4. Legal pages
Privacy policy and terms of service often require a contact email. This is a legal requirement in many countries.
How to fix: if the email is required, obfuscate it. Use JavaScript or CSS to hide it from bots.
5. Blog posts
Authors sometimes include their email in blog posts. This is a common source of spam.
How to fix: avoid including emails in blog content. Use a contact form or social media links instead.
How to protect emails from spam bots
Five ways.
1. Use a contact form
Instead of listing an email, use a contact form. The form sends the message to your email without exposing the address.
Pros: no plaintext email, spam protection via CAPTCHA.
Cons: users may prefer direct email.
2. Obfuscate the email
Obfuscation hides the email from bots but keeps it visible to users. Methods:
— JavaScript: the email is inserted via JS, which bots may not execute;
— CSS: the email is reversed or split;
— HTML entities: contact@example.com.
Pros: email is visible to users.
Cons: sophisticated bots can decode obfuscation.
3. Use an image
Display the email as an image instead of text. Bots cannot read images (unless they use OCR).
Pros: effective against most bots.
Cons: users cannot copy the email; screen readers cannot read it.
4. Use a contact form with CAPTCHA
A contact form with CAPTCHA prevents bots from submitting spam. The email is not exposed.
Pros: effective spam protection.
Cons: CAPTCHA can be annoying for users.
5. Use a separate email for public contact
If you must list an email, use a separate address for public contact. If it gets spam, you can change it without affecting your main email.
Pros: main email is protected.
Cons: you still receive spam on the public email.
Plaintext emails and SEO
Plaintext emails do not directly affect SEO. But they affect:
Security. Spam and phishing attacks can damage your site reputation. If your site is flagged as malicious, search engines may remove it from search results.
User trust. Sites with visible plaintext emails may look less professional.
Spam filters. If your domain is used for spam, your emails may be flagged as spam by email providers. This affects communication with users.
Learn more about security in the article DDoS Protection and HTTPS Security.
How to check plaintext emails across your site
Checking every page manually is slow. For a site with many pages, use the SEO Audit by SerpMax. The tool crawls all pages and shows:
— pages with plaintext emails;
— pages with mailto links;
— recommendations for protection.
This gives you a complete list of issues in one report.
How often to check plaintext emails
Recommended frequency:
— After adding a new contact page or form — check manually.
— After a redesign or CMS migration — email exposure may change.
— Once every six months — as part of a security audit.
— If you notice an increase in spam — check immediately.
Frequently Asked Questions
What is a plaintext email?
A plaintext email is an email address written in plain text in the HTML code or visible on the page. It can be read by spam bots and harvested for spam campaigns.
Why are plaintext emails a problem?
They expose your email to spam bots, increase spam and phishing risk, and reduce privacy. For business sites, plaintext emails are a common source of attacks.
How do I check for plaintext emails?
Use the plaintext email checker. Or view the page source and search for @. Or use Chrome DevTools.
How do I protect emails from spam bots?
Use a contact form instead of plaintext email. Obfuscate the email with JavaScript, CSS, or HTML entities. Use an image. Use a separate email for public contact.
Do plaintext emails affect SEO?
Not directly. But they affect security and user trust. If your site is flagged as malicious due to spam, search engines may remove it from search results.
What is the best way to protect email?
The best way is to use a contact form. It protects the email from bots and provides spam protection via CAPTCHA. If you must list an email, obfuscate it.
Can bots read obfuscated emails?
Sophisticated bots can decode some obfuscation methods. JavaScript obfuscation is more effective than CSS or HTML entities, but no method is 100% secure.
How often should I check for plaintext emails?
After adding new contact pages or forms, after redesigns or migrations, once every six months as part of a security audit. If spam increases, check immediately.
