OddThinking

EmailShroud is a WordPress plugin.

The latest version is 2.2.1, and can be downloaded here or via WordPress.org.

What does it do?

In order for spammers to send email to millions of people, they need millions of email addresses. One way to get these addresses is to automatically search the web, harvesting email addresses from unsuspecting web-sites. EmailShroud helps to protect email addresses that are published on a WordPress Blog.

Note: EmailShroud is not like most of the anti-spam plugins for WordPress. EmailShroud does not protect the blog against Comment Spam. EmailShroud helps to protect the owner, authors and other people mentioned on a blog from receiving email spam.

How does it work?

EmailShroud does more than just use “escape codes”, which is a poor-man’s solution to this problem.

It uses JavaScript to “obfuscate” the email address. Spammers don’t run JavaScript during their harvesting, as it would take too much effort and is unlikely to help produce many more email addresses. Almost all browsers used to actually read blogs do run JavaScript – the browser transparently decodes the email address without the reader even noticing.

EmailShroud gracefully handles browsers that are not running JavaScript.

How do I install it?

Installation is simple, and you should have the basic system up and running in a couple of minutes.

1. Install the files.
   1. Get the latest version of EmailShroud.
   2. Create a directory called emailshroud on your WordPress server under the wp-content\plugins\ subdirectory.
   3. Extract the downloaded files into that directory.
2. Activate the plug-in.
   1. Login to your WordPress Admin site.
   2. Select the Plugins page.
   3. If you were running an earlier version of EmailShroud, find it in the list and click Deactivate.
   4. Find the new EmailShroud entry and click Activate.

The system is now installed and activated. It will handle almost all of the situations and almost all of your readers’ browsers.

You may like to read Limitations of EmailShroud to find out about the tiny minority of situations that EmailShroud won’t automatically handle.

You may like to read Advanced Settings of EmailShroud to find out about how to improve the look-and-feel for the tiny minority of users who aren’t running JavaScript, and how to improve the security beyond the defaults.

How do I upgrade it?

Follow the same instructions above. Upgrading from EmailShroud 1.0.1, 2.0, 2.1 and 2.2 is suggested but not mandatory.

Support

Feel free to report any bugs you notice or any suggestions you have. I plan to spend a limited amount of time on support.

Acknowledgements and Further Reading

Competing WordPress Plugins

There are several WordPress plugins with similar goals.

• Obfuscate-Email and Email-Immunizer take a simple approach of simply escaping some or all of the characters (using numeric character references). On the down side, this approach is bother more easily cracked than EmailShroud (the regular expression used to search for emails just needs a little bit of buffing up, without any additional computational complexity) and is commonly used (making it worth cracking). On the upside for these plugins, I have no experimental evidence that spam-harvesters are bothering to crack it now. They also do not require Javascript, add less overhead to the size of the page, and don’t interfere with your subject, cc and bcc tags.
• Transpose Email is a much simpler that EmailShroud. As of V1.2, it doesn’t automatically replace all email addresses – it requires the author to manually enter a special piece of code instead of an email address. This makes it harder to use, but it won’t trip up if you are someone who has to put usernames and passwords in a URL. It requires your reader’s browser to support JavaScript. Nonetheless, this plugin is worth keeping an eye on as a potential alternative to EmailShroud.

Similar Technology

• Joe Maller describes a similar technology – some of the ideas from that site were helpful in improving my code for Version 1.
• EmailCloak offer a similar technology for a small price.
• The Enkoder plugin for Ruby on Rails has a similar goal. It includes some very basic encryption (ROT3?). It isn’t suitable for WordPress, but may work with some of the WordPress competitors.

Inspiration and Sources

• The “regular expressions” that form the basis of the code were influenced by some of the items at the RegExLib.com Regular Expression Library.
• I have tried hard to comply to the official advice on writing a plugin.
• Incorporates DES code from Paul Tero and Michael Hayworth.
• Incorporates URLencoding and Base64 encoding code from Stephen Ostermiller.
• XHTML compliance based on some ideas by Aristotle Pagaltzis and Alastair.