Advice on protecting a new site from email spam

[tuqqer]

We're creating a new site for a new product. One of the links that we want to have is a classic "Contact us" link.

I've seen this done two ways:

1. Link directly opens up the user's email, ready to email to "support@domain.com"

2. Link opens up to a page there on the site, where user can fill out a form, and click Send.

Is there less chance of getting spam by choosing the second option? Any benefits to using one over the other?

[M A V I C]

#2 for sure, as long as the email it's being sent to isn't in the HTML anywhere.

#1 is a sure-fire way to get a ton of spam. IMHO, an email address should never, ever, ever, ever be put in plain text on a site.

[Jem]

There are simple javascript code scripts that obfuscate the actual email address embedded in the HTML and thus render it difficult if not impossible for a spambot to pick up the address off your page. In otherwords, if you look at the HTML, you don't see the email address. But if you render it in a web browser, the email link is created on the fly as it is needed. I'd use one of these if possible.

Many forms have the "sendto" address right in the HTML... not sure if spambots are capable of finding those, but I wouldn't put it past them.

[what4]

Spamstopper is a free app that does what Jem says. I use it. It disguises your html "mailto" email address with some javascript.

http://www.macupdate.com/info.php/id/10623

[ArtP]

I recently started using Enkoder for this:

http://www.macupdate.com/info.php/id/10738

Works with Javascript like the above and it is also free.

[trisho.]

Thanks what4 & ArtP. Those are invaluable.

[tuqqer]

Thanks what4 & ArtP.

Ditto. Am checking them out now. Definitely not going to just list my email any more! I got away with doing it for years, but in the last 7 months, I get about 200 spam messages these days. I may have to change all my current emails@MYDOMAIN.com soon.

[Seacrest]

Spammers will also send mail by default to common addresses like info@, support@, webmaster@, etc.

What I do is put a contact form that keeps the address server-side and filter any messages that do not come from the form.

[M A V I C]

I have yet to find an email address encoding system that hasn't eventually been discovered by spammers. They will help in the short run, but in the long run the only solution is to use a form and keep the address out of the client-side.