Testing the Security of Your Website – Part 2

Publishing Emails

You should not publish email addresses on your website, as spammers run programs that sweep the web looking for email addresses to build a database to send spam or sell said database to other spammers. This kind of program looks specifically for the HTML code “mailto:,” meaning clickable email addresses are more prone to be collected by spammers.

If you really need to publish an email address on your website, do not make it clickable. You should also replace the “at” and “dot” symbols for something else, such as “[at]” and “[dot].” So, an email address such as “[email protected]” would be published as “name [at] yourwebsite [dot] com. ”

If you need users to contact you or your team, create a contact form, which hides email addresses and provides a protection against spam – if the form is built right, which is our next topic.

Also, you should not create obvious emails addresses, such as [email protected], [email protected], [email protected] etcetera. Even if these emails are not publicly exposed, spamming software tries to send spam to this kind of email, and you will get spam on these accounts even if you never published them anywhere.