So the question is not “should people be able to email me.” Of course they should. The question is “does the literal address need to sit in the raw HTML where a bot can grab it in a fraction of a second.” Usually it does not.

The honest part first

There is no way to publish an address that a determined scraper cannot eventually read. Anyone who tells you their trick is bulletproof is selling something. Modern harvesters can run JavaScript, so even clever assembly tricks fall to the patient ones.

But that is the wrong bar. Most harvesting is cheap and lazy. It downloads the raw HTML, runs a quick pattern match for the @ sign, and moves on to the next site. It does not run JavaScript, because running a full browser on millions of pages is slow and expensive. So the realistic goal is simple: do not hand the easy bots a free address, and make yourself not worth the effort for the rest. That removes the large majority of the spam, which is the whole point.

The best option: do not publish the address at all

The single most effective thing you can do is replace the address with a contact form. A form gives people a way to reach you with nothing for a harvester to scrape, because the address never appears on the page. It also lets you add a spam check and route messages where you want them.

This is what Desk Ready does. The contact form is the front door. The form, not a published address, should be how most people reach you.

If you do want to show an address too

Some people prefer to see a real address, and that is fair. The trick is to keep it out of the raw page source and rebuild it for real visitors with a little JavaScript. The page ships a scrambled version with no @ sign and nothing that looks like an email. When a real person’s browser loads the page, a few lines of script unscramble it and turn it back into a normal, clickable link. A lazy harvester reading the raw HTML finds nothing useful. A human sees a working email link.

For the rare visitor with JavaScript turned off, the link should fall back to your contact form, so nobody is ever stuck.

That is exactly how Desk Ready’s own pages work now. View the page source on our contact or privacy page and you will not find our address written out anywhere, even though it shows up fine in your browser.

Tricks that are not worth your time

A few popular tactics look clever but do not earn their keep:

• Writing it as “name at domain dot com.” Humans find it annoying to retype, you lose the one-click link, and pattern matchers learned this years ago. You pay a real cost in convenience for almost no protection.
• HTML entity codes alone. Turning the letters into codes like s does nothing, because every browser and every scraper decodes them automatically before reading the page. It feels like obfuscation but is not.
• Posting the address as an image. It does hide the text, but look at what it costs. A blind visitor’s screen reader can only speak the address if you put it in the image’s alt text, and anything in the alt text sits right back in the HTML for scrapers to read. Skip the alt text and that visitor gets nothing at all. Either way nobody can click it and nobody can copy it. You traded a spam problem for an accessibility problem, which is a bad trade.

The backstop that actually matters

Obfuscation reduces the flood. It does not replace good hygiene, so pair it with these:

• Use a role address you can filter or replace, like hello@ or info@ rather than your personal name. If it ever does get harvested, you can add filters or retire it without changing your identity.
• Lean on your mail provider’s spam filtering, which is the real last line of defense for anything that slips through.
• If your site sits behind Cloudflare or another CDN (a content delivery network, a service that stands between your website and its visitors and handles the traffic), check for automatic email obfuscation. Cloudflare offers it for free, and it applies the scramble-and-rebuild trick across your whole site as a second layer. If you are not sure whether your site uses one, whoever manages your hosting can tell you in one email.

Takeaway

Put a contact form front and center so most people never need a raw address. If you also want to show one, keep it out of the page source and let the browser rebuild it for real visitors, with a fallback to the form. Skip the gimmicks that cost your readers more than they cost the spammers. None of this is bulletproof, and it does not need to be. It just needs to make you not worth the trouble.