EmailShield for WordPress
Protect email addresses from spam harvesters using JavaScript obfuscation and optional Cloudflare Turnstile verification. Free, no account needed.
EmailShield keeps your email addresses out of the hands of spam harvesters without breaking usability for real visitors. It works in two modes:
Simple mode (default)
The email address is split, reversed, and base64-encoded in the HTML. JavaScript reassembles it invisibly on page load. No external services. No API keys. Works out of the box.
Turnstile mode (optional)
A Cloudflare Turnstile challenge runs silently before the email is revealed via the REST API. Useful for high-value addresses where even JS-encoded emails are a concern. Requires a free Cloudflare account.
Both modes include a `<noscript>` fallback using WordPress’s `antispambot()` for visitors with JavaScript disabled.
Features
- JavaScript obfuscation (base64 + string reversal)
- Optional Cloudflare Turnstile CAPTCHA gating
- Shortcode: `[email_protect address=”info@example.com” label=”Email us”]`
- Gutenberg block: “EmailShield Email Link”
- Legacy shortcode support: `[obfuscate_email]`
- `<noscript>` fallback via WordPress `antispambot()`
- Built-in rate limiting (10 requests/minute per IP)
- Admin dashboard widget with daily statistics
- Multisite compatible
- Clean uninstall — removes all options and transients
- Fully free. No license keys, no upsells.