About Clear-Text Email Addresses
What is a clear-text email address?
A clear-text email address is one written plainly in the page source, exactly as a person would read it. Automated collectors crawl the web looking for that pattern, and an address they find is added to lists that are sold and resold indefinitely.
The check looks for that pattern and reports any address it finds. It is a conservative reading, and understanding where it comes from makes it easier to decide what to do about it.
Where this recommendation comes from
Avoiding plain-text addresses is one of the older principles in web publishing, and it dates from a period when spam filtering was poor and harvesting was rampant. An address picked up by a scraper was effectively ruined: it received spam permanently, no matter what you later changed on the page.
The advice made obvious sense then, and it hardened into a standard recommendation that most audit tools including this one still apply.
Its force has softened since. Filtering is vastly better than it was, and for most businesses a published address is now an annoyance rather than a serious cost, which is worth saying plainly rather than repeating the original warning unchanged.
What still holds
Harvesting has not stopped, because it remains cheap and entirely automated. Role addresses such as info@ or sales@ are targeted hardest, since they are predictable enough to guess without scraping anything.
Automated outreach has changed the shape of the problem more than filtering has solved it. A published address attracts a steady flow of plausible, personalised solicitations, and those cost more attention than obvious spam ever did because each one takes a moment of judgement.
The cost also tends to land on whoever owns the address rather than on whoever published it, which is why the decision is worth making deliberately.
When publishing an address plainly is the right call
Often. Being reachable is a genuine trust signal, and for local businesses, agencies and anyone selling to people who want to talk to a human first, a visible address earns more than the spam costs.
Legal and regulatory requirements in some markets settle the question outright. So does a support model where customers expect to reply to a person rather than complete a form.
If you have weighed that and published the address on purpose, this check flagging it is not something you need to act on. The point is that it should be a decision rather than something a page inherited.
Practical middle ground
- Use a contact form for general enquiries, and publish an address for the cases a form handles badly.
- Prefer a filtered role address over a personal one where an address must be visible.
- Obfuscate it if you want it readable without being trivially parsed.
- Mark contact details up with schema so the systems that should have them do.
- Do not hide contact details entirely; that costs more credibility than spam costs nuisance.
- Check pages published by other teams, where addresses appear without anyone weighing it.
What this tool checks
The tool scans the page source for clear-text email addresses and reports whether any were found.
A found address currently counts as a failed check, which reflects the conservative principle above rather than a judgement about your particular site. Read it as a prompt to confirm the address is there on purpose.
Where to go next
Contact details are part of a wider picture of how your domain handles email and identity. Check your
SPF and
DMARC records if the domain sends mail, and confirm your contact information is marked up correctly with the
schema markup tester.