About this plugin
🚨 Tired of spam bots harvesting your email addresses?
Standard obfuscation techniques—like ROT13, CSS direction tricks, HTML entities, or simple Base64/XOR encoding—are effortlessly bypassed in milliseconds by modern scrapers, AI crawlers, and headless browsers.
🔐 Crypto Mailto Defender takes a radically different approach: real server-side cryptography. Your email addresses never exist in the page source code or in the DOM until a verified human physically interacts with them.
⚡ How It Works Under the Hood
- Global Server-Side Interception: The plugin captures the final HTML output before it leaves your server, finding every mailto: link and plain-text email across your entire layout.
- Authenticated AES-256-GCM Encryption: Every email is encrypted using a unique 256-bit secret key, a 96-bit Initialization Vector (IV), and a 128-bit authentication tag, replacing the address in the HTML with a clean, customizable mask (e.g., ********@domain.com).
- Hardware Human Proof & SHA-256 PoW Verification: When a visitor clicks or taps an email, the plugin verifies physical interaction metrics (hold duration, bounding-box geometry, hardware score, and a cryptographic SHA-256 Proof-of-Work) and performs a secure Server-Side AJAX request to decrypt the address on the fly. The encryption key never leaves your server.
✨ Key Features
- 🚀 Ultra-Fast Early-Exit Engine: Zero CPU wasted. If a page does not contain an @ symbol, the regex engine is completely bypassed in 0ms, and frontend JS is loaded non-blockingly via defer.
- 🤖 Anti-Headless Bot Shield: Defeats automated scraping tools (Puppeteer, Playwright, Selenium, WebDriver, cURL, Python) by validating real hardware press timing, pointer telemetry, WebGL software renderer detection, isTrusted events, and Same-Origin headers.
- ⚡ 100% Cache-Friendly: Works seamlessly with aggressive Full-Page Caching ( Cloudflare, WP Rocket, LiteSpeed Cache, W3 Total Cache ) without breaking when WordPress nonces expire.
- 🌐 Global Page Builder Compatibility: Protects emails everywhere—inside standard posts, headers, footers, widgets, AJAX forms, and builders like Elementor, Divi, Bricks, Oxygen, Beaver Builder, WPBakery, Breakdance, and Gutenberg.
- 📋 Smart 1-Step or 2-Step UX: Choose whether text links are revealed on the first click and open the mail client on the second click, or launch mailto: immediately on the first click. Icon and button links always launch mailto: immediately.
- 🛡️ Built-In Rate Limiting: Protects your admin-ajax.php endpoint against flooding attacks using spoof-resistant IP verification ( REMOTE_ADDR ) and Object Cache support.
- ♿ Accessible by Design: Full keyboard navigation support ( Tab + Enter / Space ) and screen-reader friendly attributes.
💖 Support the Project
Crypto Mailto Defender is 100% free, open-source, and has no paid “Pro” upsells. If this plugin saves your inbox from spam, consider buying me a coffee via PayPal!
Acknowledgements
The architectural concept and research behind this plugin were inspired by the article Email Obfuscation by Spencer Mortensen.