Crypto Mailto Defender

Tired of spam bots scraping your email addresses? Standard obfuscation techniques (like ROT13, CSS direction tricks, or Base64) are easily bypassed by modern crawlers and scrapers.

Crypto Mailto Defender uses real cryptography to protect your links, ensuring absolute security without compromising user experience.

The plugin utilizes a global output buffering system to intercept your HTML server-side before it reaches the browser. It encrypts your mailto: links (and plain text emails) using an automatically generated AES-256-CBC key and replaces them with a masked version (e.g., ********@domain.com).

When a real human user clicks the link or the icon, the plugin executes a secure, nonce-protected Server-Side AJAX request to instantly decrypt the payload and seamlessly open their mail client. The encryption key never leaves your server.

Key Features

• Zero-Impact Performance: JavaScript and CSS assets are dynamically injected only on pages that actually contain encrypted email links. No unnecessary code loading.
• Global Interception: Catches emails everywhere—inside standard content, widgets, headers, footers, and complex Page Builder layouts (Elementor, Gutenberg, Bricks, etc.).
• Rate Limiting: Built-in protection against AJAX flooding to prevent server abuse.
• Strict Bot Protection: Optionally enforce hardware-level interactions (isTrusted events) to block automated JS click bots like Puppeteer or Selenium.
• Smart UI: Text links are elegantly revealed on the first click, while icons/buttons instantly open the native mail client.
• Forminator Compatible: Intercepts forms loaded via AJAX dynamically.

Acknowledgements The architectural idea and study behind this plugin were inspired by the article Email Obfuscation by Spencer Mortensen.