Spam Proofing Your Websites
by William Bontrager

Visitor feedback forms have been around ever since browsers have supported CGI.

They're on most professional sites. Certainly they are on those sites which best project friendly customer service.

Today, we'll use the feedback form to help spam proof your sites.

Spammer's email harvesting robots scan your site for email addresses. Then the addresses become part of spammers' mailing lists.

Here is a practical way to remove all email addresses from your site. And whether or not your sites have access to their own CGI.

(Spammers collect email addresses from other sources, too. Spam proofing sites removes only one source.)

I'm on a mission.

I don't like spammers harvesting email addresses from our sites. Uninvited, demanding our time and stealing our resources to sate their greed by pushing their impatience-soaked ideas into our faces. And I don't like them doing it to our friends.

So, I decided to do something about it.

The result is MasterFeedback, a visitor feedback form and Perl CGI script. The form contains no email addresses in the HTML code or on the page, not even in a hidden form field.

The script is freely available for download, along with a generic HTML form you can modify. This free version is for Unix servers. (Find download URL further below.)

There is also a version for:

• folks who don't have CGI for their sites.
• web sites on NT or other non-Unix operating systems.
• folks who don't want to mess with scripts but still want the benefits.

This second version requires sign-up and a monthly fee.

While I was making MasterFeedback, Mari Bontrager made graphical buttons with our email addresses as images. These will be our links to the feedback forms.

Spam proofing your sites is a simple two-step process:

1. Obtain a feedback form.
2. Eliminate all email addresses and replace them with links to your feedback forms.

That's it!

STEP 1: Obtain a feedback form.

This means you either acquire and install a script for that purpose, or you use a script hosted on someone else's server.

MasterFeedback is robust and does the job quite well. But it's not the only tool around.

~~ If you have CGI:

MasterFeedback (free) (Unix) is available for download at: http://willmaster.com/MasterFeedback/

There are dozens of free and shareware feedback scripts. They're available for all popular operating systems -- Unix, NT, Linux. Some CGI download sites are listed in the "Links and Resources" section of: http://willmaster.com/possibilities/examples.html

Whichever script you decide to use, please make sure it does not require your email address anywhere within your web page, not even in hidden form fields.

~~ If you do not have CGI (or just don't want to be bothered with it):

Remote hosted CGI is your solution. This means the forms are on your server (on your web site), but the script is on someone else's server.

Remote hosted MasterFeedback is designed so your visitors never need to leave your site. They stay with you, even when they click the submit button. The service is only $2 per month. Sign up for your 14-day free trial at http://willmaster.com/c/

STEP 2:

Eliminate all email addresses and replace them with links to your feedback forms.

(For illustration purposes, let's suppose your feedback form is at "http://www.domain.com/feedback.html" and that your email address is "name@domain.com".)

Replace all occurrences of:

<a href="mailto:name@domain.com">Write Me!</a>

with:

<a href="http://www.domain.com/feedback.html">Write Me!</a>

If you want a graphic link, just replace "Write Me!" (or other link text) with your graphic's "<IMG ..." tag.

A simple graphic with your email address as the image can present your address visually and yet not have the text anywhere in your source code. Spammers are not yet sophisticated enough to make graphic image reading robots.

(Note to users of AOL and HTML email readers: The above contains HTML code examples. If your reader shows them as links (or doesn't show them at all), you may need to view the source code in order to reveal the HTML code in its entirety.)

One more note: To spam proof your sites, no text with an email address can be in your page source code, anywhere. Not in image "alt" tags, no in META tags, not in html comment areas, nowhere. You may wish to use your word processor or page editor's search function to ensure no stray "@" characters with email addresses remain on your pages.

That's all there is to it.

Happy spammer swatting!

Copyright 1999 by William Bontrager

William Bontrager, Programmer and Publisher
"Screaming Hot CGI" programs
"WillMaster Possibilities" e-Newsletter
http://willmaster.com/possibilities/
subscribe-possibilities@willmaster.com