Email Address Obfuscation · Cloudflare Web Application Firewal...
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

!https://developers.cloudflare.com/waf/tools/scrape-shield/email-address-obfuscation/

Date: July 4, 2024

Image: Email Address Obfuscation — Hide email addresses from bots while keeping them visible to visitors. <https://developers.cloudflare.com/og-docs.png> Email Address Obfuscation Hide email addresses from bots while keeping them visible to visitors. Cloudflare Docs · developers.cloudflare.com

I recently started seeing email-decode.min.js show up on my blog posts, and I wondered what the heck ? I didn’t put it there. Turns out that cloudflare put it there from pages to safely serve email addresses for me.

inspecting the page without js running we can see that the mailto email is swapped out for email protected. Neat feature.

```
❯ curl --silent https://waylonwalker.com/diskcache-as-debounce/ | grep email
<a class="decoration-pink-500 hover:decoration-pink-300 hover:text-pink-100" href="/cdn-cgi/l/email-protection#a4ccc1c8c8cbe4d3c5ddc8cbcad3c5c8cfc1d68ac7cbc9" rel="me"><span class="__cf_email__" data-cfemail="630b060f0f0c2314021a0f0c0d14020f0806114d000c0e">[email&#160;protected]</span></a>
<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
```

Looking deeper into this article it looks like this feature comes from Scrape Shield and enabling Email Address Obfuscation.