內容簡介
Crypto Mailto Defender 是一款專為防止垃圾郵件機器人抓取電子郵件地址而設計的外掛。它利用真實的加密技術來保護您的郵件連結，確保安全性同時不影響使用者體驗。
【主要功能】
• 零影響效能：僅在包含加密郵件連結的頁面動態注入 JavaScript 和 CSS
• 全球攔截：可攔截標準內容、小工具、標頭、頁尾及複雜佈局中的電子郵件
• 速率限制：內建防止 AJAX 濫用的保護機制
• 嚴格的機器人保護：可選擇強制硬體級互動以阻擋自動化點擊機器人
• 智能使用者介面：文字連結在首次點擊時優雅顯示，圖示/按鈕則立即開啟郵件客戶端
• Forminator 相容：動態攔截透過 AJAX 載入的表單
外掛標籤
開發者團隊
原文外掛簡介
🚨 Tired of spam bots harvesting your email addresses?
Standard obfuscation techniques—like ROT13, CSS direction tricks, HTML entities, or simple Base64/XOR encoding—are effortlessly bypassed in milliseconds by modern scrapers, AI crawlers, and headless browsers.
🔐 Crypto Mailto Defender takes a radically different approach: real server-side cryptography. Your email addresses never exist in the page source code or in the DOM until a verified human physically interacts with them.
⚡ How It Works Under the Hood
Global Server-Side Interception: The plugin captures the final HTML output before it leaves your server, finding every mailto: link and plain-text email across your entire layout.
Authenticated AES-256-GCM Encryption: Every email is encrypted using a unique 256-bit secret key, a 96-bit Initialization Vector (IV), and a 128-bit authentication tag, replacing the address in the HTML with a clean, customizable mask (e.g., ********@domain.com).
Hardware Human Proof & SHA-256 PoW Verification: When a visitor clicks or taps an email, the plugin verifies physical interaction metrics (hold duration, bounding-box geometry, hardware score, and a cryptographic SHA-256 Proof-of-Work) and performs a secure Server-Side AJAX request to decrypt the address on the fly. The encryption key never leaves your server.
✨ Key Features
🚀 Ultra-Fast Early-Exit Engine: Zero CPU wasted. If a page does not contain an @ symbol, the regex engine is completely bypassed in 0ms, and frontend JS is loaded non-blockingly via defer.
🤖 Anti-Headless Bot Shield: Defeats automated scraping tools (Puppeteer, Playwright, Selenium, WebDriver, cURL, Python) by validating real hardware press timing, pointer telemetry, WebGL software renderer detection, isTrusted events, and Same-Origin headers.
⚡ 100% Cache-Friendly: Works seamlessly with aggressive Full-Page Caching (Cloudflare, WP Rocket, LiteSpeed Cache, W3 Total Cache) without breaking when WordPress nonces expire.
🌐 Global Page Builder Compatibility: Protects emails everywhere—inside standard posts, headers, footers, widgets, AJAX forms, and builders like Elementor, Divi, Bricks, Oxygen, Beaver Builder, WPBakery, Breakdance, and Gutenberg.
📋 Smart 1-Step or 2-Step UX: Choose whether text links are revealed on the first click and open the mail client on the second click, or launch mailto: immediately on the first click. Icon and button links always launch mailto: immediately.
🛡️ Built-In Rate Limiting: Protects your admin-ajax.php endpoint against flooding attacks using spoof-resistant IP verification (REMOTE_ADDR) and Object Cache support.
♿ Accessible by Design: Full keyboard navigation support (Tab + Enter / Space) and screen-reader friendly attributes.
💖 Support the Project
Crypto Mailto Defender is 100% free, open-source, and has no paid “Pro” upsells. If this plugin saves your inbox from spam, consider buying me a coffee via PayPal!
Acknowledgements
The architectural concept and research behind this plugin were inspired by the article Email Obfuscation by Spencer Mortensen.
