---
title: "How to Hide Email from Spam Bots in WordPress?"
url: https://nexterwp.com/docs/hide-email-from-spam-bots-in-wordpress/
date: 2025-05-26
modified: 2026-07-01
author: "Aditya Sharma"
description: "Do you want to protect your email address from spam bots on your WordPress site? When you display your email address in plain text, bots can find and harvest it,..."
word_count: 610
---

# How to Hide Email from Spam Bots in WordPress?

Do you want to protect your email address from spam bots on your WordPress site? When you display your email address in plain text, bots can find and harvest it, leading to unwanted spam. To keep your inbox clean and secure, it is important to hide your email from bots while still making it accessible to real visitors.

Nexter Extension includes a built-in email obfuscation tool that hides your email address from spam bots in WordPress while displaying it normally to human visitors.

**Best Used For:**

- Contact pages and About pages where email addresses are displayed publicly.

- Business websites where client-facing email addresses need protection from spam harvesters.

- Membership or community sites where member email addresses appear in user profiles or directories.

[LIVE EXTENSION LINK](https://nexterwp.com/nexter-extensions/advanced-wordpress-security/)

 

## Learn via Video Tutorial

https://youtu.be/vy2tZnM6HaU?t=752

## How to Hide Email from Spam Bots with the Nexter Extension Pro?

To set up email spam protection, from the WordPress dashboard go to **Nexter → Extensions → Security**.

In the **Advanced Security** section, enable the toggle and click the gear icon (⚙). To add similar bot protection to your contact forms, see [How to Add Google reCAPTCHA in WordPress](https://nexterwp.com/docs/add-google-recaptcha-in-wordpress/).

![](https://nexterwp.com/wp-content/uploads/2025/08/advanced-security-settings-new-1.png)

In the **Advanced Security** popup, enable the **Hide Email from Spam Bots** toggle and click **Save**.

![](https://nexterwp.com/wp-content/uploads/2025/05/hide-email-from-spam-bots.png)

Enabling the toggle activates the `[obfuscate]` shortcode. It does not change any emails on your site automatically — you place the shortcode wherever you want a protected email shown.

#### Basic usage — display an email (not clickable)

`[obfuscate [email="john@example.com](mailto:email="john@example.com)"]`

The address appears normally to visitors, but in the page source it is reversed and encoded so bots can't read it.

#### Show a clickable (mailto) email — spam-safe

Add `link="yes"` to turn it into a working email link whose address is NOT present in the page source. The `mailto:` link is assembled by JavaScript only when a real person clicks, taps, or keyboard activates it:

`[obfuscate [email="john@example.com](mailto:email="john@example.com)" link="yes"]`

Add a pre-filled subject line:

`[obfuscate [email="john@example.com](mailto:email="john@example.com)" link="yes" subject="Website Inquiry"]`

#### Shortcode attributes

| Attribute | Default | Description |
| --------- | ------- | ----------- |
| **email** | Required | The email address to protect. Must be a valid email address; otherwise, nothing is displayed. |
| **link** | `no` | Set to `yes` to display a clickable, spam-safe `mailto:` link. Set to `no` to display the email address as plain text. |
| **subject** | Empty | Pre-fills the email subject. Only applies when `link="yes"`. |
| **display** | `newline` | Set to `inline` to display the email within a line of text. Set to `newline` to display it on its own line. |
| **text** | Empty | Displays custom text (for example, "Email us") instead of the email address. |
| **class** | Empty | Adds a custom CSS class for styling. |

#### Examples

```
[obfuscate [email="sales@example.com](mailto:email="sales@example.com)" display="inline"]
```

```
[obfuscate [email="sales@example.com](mailto:email="sales@example.com)" link="yes" text="Email our team"]
```

```
[obfuscate [email="sales@example.com](mailto:email="sales@example.com)" link="yes" subject="Support"]
```

#### How to confirm it's protected

Check the RAW source, not the browser inspector:

1. On the published page, press **Ctrl + U** (Windows) or **Cmd + Option + U** (Mac) to open **View Page Source**.

2. Search (Ctrl/Cmd + F) for your address, e.g. `john@example.com`.

3. It should NOT be found. You'll only see reversed text and an encoded `data-nxt-mail` value — never a plain `mailto:john@example.com`.

> Note: The browser's "Inspect Element" tool shows the LIVE page after scripts run,

So it may display the assembled `mailto:` once you've clicked or focused the link.

Always use "View Page Source" (Ctrl+U) to see what bots actually download.

#### Good to know

- **Important**: Don't also put a plain `mailto:` in a button/widget's URL field — that link is separate and would expose the address in the source. Use `[obfuscate ... link="yes"]` for the clickable email instead.

- The clickable link requires JavaScript. With JS disabled, it stays inert (the visible address still shows) — this is by design, since the address must never exist in the source.

#### Where to use it

- Contact and About pages

- Footers and business listings

- Author/profile pages and community directories

![](https://nexterwp.com/wp-content/uploads/2025/05/obfuscation-email-demo.png)