CryptX

CryptX uses various methods to hide email addresses from spambots while keeping them functional for visitors. Methods include JavaScript encryption, Unicode conversion, and replacing emails with images or custom text.

CryptX is designed to be lightweight and only loads JavaScript when needed. The performance impact is minimal.

Yes. Under Settings / CryptX / Exceptions there is a list of addresses to leave alone. Write “info@example.com” for a single address, or “@example.com” to cover every address at that domain. CryptX leaves those addresses exactly as written — it does not mask, link or encrypt them — which is what you want for an address a helpdesk has to read out of the page, or one shown in a code example.

That distinction rests on which filter the text arrives through, and only comments can be told apart with certainty. Forum and front-end submission plugins — bbPress and BuddyPress among them — send what a visitor wrote through the same filter as your own posts, so the domain form does apply there. If your site takes text from visitors that way, exempt the individual addresses rather than a whole domain.

What about addresses at an internationalised domain?

Does it work on a multisite network?

The settings live per site, because that is where the addresses and the design live. A site administrator configures their own site as usual. Since 4.2.0 a network administrator can set the defaults a newly created site starts with, under Network Admin / Settings / CryptX — a starting point, not an instruction: sites that already exist are never changed by it, and a site administrator can change theirs at any time.

Can I use CryptX from the command line?

wp cryptx scan is the one worth knowing about. It runs every published post through the filters that render it and reports the ones that still carry a readable address -- the question you actually have after changing a setting, and the one the settings screen cannot answer, because it only ever renders a single sample. An "encoded" verdict means the address is in the page as HTML entities: invisible to a naive scanner, plain to anything that decodes them.

What the scan does not cover: widgets, comments, feeds, and anything a theme prints on its own. It is a check on your posts and pages, not a clean bill of health for the whole site.

Does it work with contact forms?

Can I disable encryption on specific posts?

For more information, visit the Plugin Homepage