Member Avatar for nigelburrell

Hi,

I'm using a joomla cms to build a website, and have discovered that joomla uses a built-in plug-in called Email Cloacking which obfuscates email addresses prior to showing them on the webpage. They simply appear as "mailto" links which makes it harder for scrapers and bots to pick up.

However, I am developing a website that requires user-login access to pages where user's email addresses need to be shown (and edited) as plain text inside text boxes. I've had to disable this joomla plug-in so that email addresses do not contain the additional javascript and scrambled information for spam protection.

My question is, even though I've disabled an important spam protection function, I'm assuming it doesn't matter given that the email addresses will appear only in webpages requiring user-login access. Obviously, if the email addresses were published in public access pages, then yes... it's a risk, but surely scrapers and bots can't access pages protected behind user logins - as they would need to simulate a user login to access such information, right?

  • 2 Contributors
  • 3 Replies
  • 124 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by FlashCreations

Dani AI

Generated

Good instincts from and a useful reminder from : putting emails behind a login lowers exposure but does not make them immune. Automated attackers can create accounts, reuse stolen credentials, script logins, or exploit site issues (XSS, misconfigured caches, analytics leaks, export tools) to harvest addresses—so treat protected pages as "sensitive" and defend them accordingly.

Practical controls to apply (server-side first)

  • Ensure strict authorization: only the account owner (or properly privileged roles) can view/edit that email. Example server-side check (generic PHP):

    session_start();
if (!isset($_SESSION['user_id']) || $_SESSION['user_id'] !== (int)$requested_user_id) {
  http_response_code(403);
  exit;
}

  • Protect edit forms with CSRF tokens and validate inputs server-side. Send a confirmation email whenever an address is added or changed (verify the new address before accepting it).

  • Avoid exposing emails in URLs, page metadata, or third-party analytics/console logs.

Operational and platform hardening

  • Prevent caching of authenticated pages (Cache-Control: private/no-store, respect cookies) so CDNs or proxies do not serve private pages to others.
  • Mitigate abusive registrations: email verification, block disposable domains, rate-limit signups and logins, consider adaptive bot checks or CAPTCHAs for suspicious flows.
  • Prevent XSS and content injection so DOM-resident emails cannot be exfiltrated via injected scripts. Sanitize outputs and use CSP where practical.

Audit and privacy hygiene

  • Mask emails when shown to other users (e.g., a****@example.com) and only reveal full addresses to the owner when editing.
  • Avoid logging plaintext PII in publicly accessible logs or third-party services; rotate/limit access to backups and exports; monitor for abnormal access patterns.

Checklist: server-side auth, CSRF, HTTPS+secure cookies, caching rules, email verification, rate limits, XSS/CSP, and careful logging. These measures keep authenticated email displays usable while minimizing harvest risk.

Recommended Answers

All 3 Replies

Member Avatar for FlashCreations

Correct, unless these bots can register on your sites and access the page with your email. You can always protect your email simply by making it an image and putting that image on your page instead of using a plugin like this.

Member Avatar for nigelburrell

Correct, unless these bots can register on your sites and access the page with your email. You can always protect your email simply by making it an image and putting that image on your page instead of using a plugin like this.

That's true, good idea. I might pursue this option and see if it works well. Thanks for your response.

Member Avatar for FlashCreations

You're welcome. You know you can also create your own contact form (In a language such as PHP or by using a free service) so that no one would know your email, but that is totally up to you. I ask though if you have no further questions to mark this thread as solved.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.