Hide email addresses from spam bots, not from visitors
Cover Email Address encodes every character of an email address so a browser still shows and links it normally, while a bot scraping the page source finds nothing readable.
- A [cover_email] shortcode for any address you place manually.
- Automatically covers every address already in post content.
- Optionally shows the real address only to logged-out visitors.
- Encodes every character, not just some, unlike WordPress's own antispambot().
What does Cover Email Address do?
The cover_email module registers a [cover_email] shortcode that outputs an email address with every character encoded as an HTML entity, and its mailto: link, if used, percent-encoded too. A browser decodes and renders both normally, so the address displays and the link still opens a mail client, while a bot reading the raw HTML source sees only entity codes, never the plaintext address. When "Automatically cover every email address found in post content" is enabled, a content filter finds and encodes plain-text and mailto addresses in every post automatically, optionally skipped for logged-in visitors so they can still copy the real address.
Publishing an email address invites the bots that scrape it
Any readable address in a page's source is a target, and WordPress's own built-in defence only goes halfway.
Any address in your page source is fair game
A bot scanning a page's HTML doesn't care whether the address sits in a contact page footer or inside a blog post; if it's readable text, it gets added to a list.
WordPress's built-in protection leaves half the address exposed
Core's own antispambot() function only encodes some characters, which stops the crudest scrapers but leaves enough plaintext for a more capable one to still read.
Encode every character, not just some
The module turns each character of an address, and its mailto link, into its own entity or percent-code, so nothing plaintext survives in the page source.
Full character encoding
Every character of the visible address gets entity-encoded, and every character of a mailto href gets percent-encoded, unlike partial encoding.
Works automatically, or on demand
Use the [cover_email] shortcode for one specific address, or let the module find and cover every address already in post content.
Keeps the real address for people who need it
Signed-in visitors can still see the actual address if you choose, useful for anyone exporting or copying it internally.
Email protection covered from every angle
Every capability below is present in the supplied PHP class and its settings registration.
[cover_email] with full control
Accepts a specific email, an optional mailto link with subject, custom display text and a CSS class.
Randomized entity encoding
Each character becomes a decimal or hex HTML entity chosen at random, so the encoded output isn't a predictable, matchable pattern.
Auto-cover post content
A single setting scans the_content and covers every plain-text or mailto address it finds, with nothing to edit manually.
Logged-out visitors only, if you choose
An optional setting shows the real address to signed-in users while still covering it for everyone else.
Avoids false positives
A trailing file extension like .png or .pdf gets checked before covering, so tokens like logo@2x.png don't get mistaken for an address.
Encodes the href too
An existing mailto: link in the content gets its address percent-encoded inside the href itself, not just the visible text.
Where covering an address helps most
The module supports every place a real, working address needs to stay public without being scraped.
Contact and about pages
Publish a real, clickable email address without leaving it as plaintext for every scraper that visits the page.
Blog posts and documentation
Cover an address that's simply mentioned inside an article's content, not just one placed deliberately with a shortcode.
Membership and internal sites
Show the real address to logged-in members while keeping it hidden from the logged-out visitors and bots that make up most traffic.
Stay reachable, stay off the lists
The module combines full encoding, automation and visitor-aware targeting without changing how an address looks.
A quick check, not a heavy scan
The verified implementation skips work entirely on content with nothing to cover.
Runs only when content has an "@"
The automatic content filter exits immediately if the rendered content has no "@" character at all, skipping the regex work entirely.
One filter, applied after rendering
Covering runs on the_content at priority 20, after shortcodes and formatting have already produced the final HTML.
Lightweight per-character encoding
Encoding a short address is a simple character loop, not a heavier parsing or lookup operation.
Full coverage, nothing left in plaintext
The code encodes an address completely, validates every match, and avoids touching content it shouldn't.
No address left partially exposed
Every character of the address, and of a mailto href, gets encoded, closing the gap that partial encoding like antispambot() leaves open.
Randomized, not predictable
Each character's entity form is chosen at random between decimal and hex, avoiding a fixed, easily-reversed encoding pattern.
Validated before covering
Both the shortcode and the automatic content filter check that a matched string is actually a valid email through is_email() before doing anything with it.
Doesn't touch what it shouldn't
The automatic matcher requires whitespace or a tag boundary before an address and excludes filename-like tokens, avoiding accidental encoding inside attributes or URLs.
Built around native WordPress content and shortcode APIs
The supplied code integrates through APIs present in WordPress core. No compatibility claim beyond the verified implementation is assumed.
the_content, priority 20
Automatic covering runs after WordPress has already applied wpautop and shortcodes, so it operates on the final rendered HTML.
Standard WordPress shortcode
[cover_email] registers through add_shortcode() and works anywhere shortcodes are already supported.
is_email() and wp_check_filetype()
Both functions come directly from WordPress core, so address validation follows the same rules WordPress itself uses.
TheOneWP versus common alternatives
Compare the verified Cover Email Address implementation with WordPress's own built-in protection.
| Capability | TheOneWP Cover Email Address | Other common solutions |
|---|---|---|
| Character coverage | Every character of the address and its mailto href encoded | WordPress's built-in antispambot() leaves roughly half in plaintext |
| Automatic coverage | One setting covers every address already in post content | Usually requires manually wrapping each address in a shortcode |
| Visitor awareness | Optional: show the real address to logged-in users only | Typically all-or-nothing for every visitor |
| False-positive handling | Skips filename-like tokens automatically | Manual encoding has no such safeguard |
| Administration | Two settings plus a flexible shortcode | May require a separate anti-spam plugin just for this |
Protect an address in four steps
Decide between automatic coverage and the shortcode based on where the address already lives.
Enable Cover Email Address
Activate the module from the TheOneWP settings.
Decide on automatic coverage
Turn on "Automatically cover every email address found in post content" to protect addresses already published, with nothing to edit.
Choose visitor targeting, if needed
Enable "Only cover for logged-out visitors" if signed-in users should keep seeing the real address.
Use the shortcode for anything else
Place [cover_email email="you@example.com" link="yes"] anywhere you want full control over a specific address.
Protect addresses without hiding them from people
A few habits keep the protection effective without getting in anyone's way.
Use automatic coverage for existing content
It's the fastest way to protect addresses already published across posts and pages without editing each one.
Reserve the shortcode for deliberate placement
Use it when you want control over the display text, subject line or styling of one specific address.
Enable visitor targeting only if it's genuinely useful
Showing the real address to logged-in users only matters if those users actually need to copy it.
Check a live page's source occasionally
Confirm a covered address actually renders as entities in the HTML, not as plaintext, especially after a theme or builder update.
Avoid assumptions that leave addresses exposed
The module has clear rules about what it covers and when, that are easy to misread at a glance.
Forgetting file-like tokens are intentionally skipped
A string like logo@2x.png won't get covered, since it's treated as a filename rather than an address, by design.
Assuming automatic coverage is on by default
The module ships with automatic content coverage off; it needs to be enabled explicitly in settings.
Expecting logged-in users to see covered addresses too
With "Only cover for logged-out visitors" enabled, a signed-in user sees the real, uncovered address by design.
Cover Email Address FAQ
These answers come directly from the verified class and its settings registration.
What does Cover Email Address do?
It encodes every character of a published email address, and its mailto link if used, so a browser displays and opens it normally while a bot reading the page source finds no readable address.
How is this different from WordPress's built-in antispambot() function?
antispambot() only encodes some characters of an address; this module encodes every character of both the visible text and the mailto href.
Do I need to use a shortcode for every address?
No. Enabling automatic coverage finds and covers every plain-text or mailto address already in post content, without any manual editing.
Can I show the real address to logged-in users?
Yes. An optional setting covers addresses only for logged-out visitors, so signed-in users still see the actual address.
Will this break a mailto link on my site?
No. The link's href gets percent-encoded rather than removed, so clicking it still opens the visitor's mail client normally.
Does it accidentally cover things that aren't email addresses?
No. A trailing file extension like .png or .pdf gets checked first, so filename-like tokens such as logo@2x.png are left alone.
Can I control how a specific address looks or links?
Yes, through the [cover_email] shortcode, which accepts custom display text, a mailto link with a subject line, and a CSS class.
Does automatic coverage run on every page load?
It runs on the the_content filter for rendered posts; if the content has no "@" character at all, the check exits immediately without further processing.
Is the encoding the same every time for the same address?
No. Each character's entity form gets chosen at random between decimal and hex, so the encoded output varies between renders.
Does this module validate that a matched string is really an email address?
Yes. Both the shortcode and the automatic content filter check the string with WordPress's own is_email() before covering it.
Stop feeding your email address to spam bots.Publish it safely instead.
Use Cover Email Address to encode every character of an address, automatically or through a shortcode, without changing how it looks to visitors.