Title: antispambot
Published: April 25, 2014
Last modified: August 20, 2026

---

# antispambot( string $email_address, int $hex_encoding ): string

## In this article

 * [Description](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#description)
 * [Parameters](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#changelog)
 * [User Contributed Notes](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#user-contributed-notes)

[ Back to top](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#wp--skip-link--target)

Obscures email addresses in HTML to prevent spam bots from harvesting them.

## 󠀁[Description](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#description)󠁿

Typically this will randomly replace characters from the email address with HTML
character references; however, when the hex encoding parameter is set, some characters
will also be represented in their percent-encoded form.

Because this function is randomized, the outputs for any given input may differ 
between calls. This helps diversify the ways the email addresses are obscured.

When non-UTF-8 inputs are provided, any spans of invalid UTF-8 bytes will be passed
through without any obfuscation.

Example:

    ```php
    $email      = 'noreply@example.com';
    $obscured   = antispambot( $email );
    $obscured === 'noreply@example.com';

    // Hex-encoding also obscures characters with percent-encoding.
    $obscured   = antispambot( $email, 1 );
    $obscured === '%6eore%70l%79@%65x%61mple%2e%63%6fm';

    // Non-UTF-8 characters are not obfuscated. "\xFC" is Latin1 "ü".
    $obscured   = antispambot( "b\xFCcher@library.de" );
    $obscured === 'b�cher@library.de';
    $obscured === "b\xFCcher@library.de"
    ```

## 󠀁[Parameters](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#parameters)󠁿

 `$email_address`stringrequired

Email address.

`$hex_encoding`intoptional

Set to 1 to enable hex encoding.

## 󠀁[Return](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#return)󠁿

 string Converted email address.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#source)󠁿

    ```php
    function antispambot( $email_address, $hex_encoding = 0 ) {
    	$obfuscated     = '';
    	$at             = 0;
    	$end            = strlen( $email_address );
    	$invalid_length = 0;

    	while ( $at < $end ) {
    		$was_at = $at;
    		if (
    			0 === _wp_scan_utf8( $email_address, $at, $invalid_length, null, 1 ) &&
    			0 === $invalid_length
    		) {
    			break;
    		}

    		$character_length = $at - $was_at;

    		if ( $character_length > 0 ) {
    			$character = substr( $email_address, $was_at, $character_length );

    			switch ( rand( 0, 1 + $hex_encoding ) ) {
    				case 0:
    					$code_point  = mb_ord( $character );
    					$obfuscated .= "&#{$code_point};";
    					break;

    				case 1:
    					$obfuscated .= $character;
    					break;

    				case 2:
    					for ( $i = 0; $i < $character_length; $i++ ) {
    						$hex_value   = bin2hex( $character[ $i ] );
    						$obfuscated .= "%{$hex_value}";
    					}
    					break;
    			}
    		}

    		if ( 0 !== $invalid_length ) {
    			$obfuscated .= substr( $email_address, $at, $invalid_length );
    		}

    		$at += $invalid_length;
    	}

    	return str_replace( '@', '&#64;', $obfuscated );
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/formatting.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/formatting.php#L2952)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/formatting.php#L2952-L2999)

## 󠀁[Related](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#related)󠁿

| Uses | Description | 
| [_wp_scan_utf8()](https://developer.wordpress.org/reference/functions/_wp_scan_utf8/)`wp-includes/compat-utf8.php` |

Finds spans of valid and invalid UTF-8 bytes in a given string.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#changelog)󠁿

| Version | Description | 
| [7.1.0](https://developer.wordpress.org/reference/since/7.1.0/) | Masquerades multibyte characters. | 
| [0.71](https://developer.wordpress.org/reference/since/0.71/) | Introduced. |

## 󠀁[User Contributed Notes](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#user-contributed-notes)󠁿

 1.   [Skip to note 4 content](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#comment-content-756)
 2.    [Codex](https://profiles.wordpress.org/codex/)  [  11 years ago  ](https://developer.wordpress.org/reference/functions/antispambot/#comment-756)
 3.  [You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%23comment-756)
     Vote results for this note: 6[You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%23comment-756)
 4.  **Example**
 5.      ```php
         /**
          * Hide email from Spam Bots using a shortcode.
          *
          * @param array  $atts    Shortcode attributes. Not used.
          * @param string $content The shortcode content. Should be an email address.
          * @return string The obfuscated email address. 
          */
         function wpdocs_hide_email_shortcode( $atts , $content = null ) {
         	if ( ! is_email( $content ) ) {
         		return;
         	}
         	return '<a href="' . esc_url('mailto:' . antispambot( $content ) ) . '">' . esc_html( antispambot( $content ) ) . '</a>';
         }
         add_shortcode( 'email', 'wpdocs_hide_email_shortcode' );
         ```
     
 6.  To use this in your WordPress Content area all you have to do it wrap it in a 
     short code.
 7.      ```php
         [email]john.doe@mysite.com[/email]
         ```
     
 8.  You can also use this in a plain text widget if you add this filter to your function
     file as well.
 9.      ```php
         add_filter( 'widget_text', 'shortcode_unautop' );
         add_filter( 'widget_text', 'do_shortcode' );
         ```
     
 10. _Edited with a contribution from @johnrafferty_
 11.  * Escaping URL in href attribute will add `http://` before email address. In 
        lack of better option, it’s more appropriate to use `esc_attr()` instead.
      * [Milana Cap](https://profiles.wordpress.org/milana_cap/) [8 years ago](https://developer.wordpress.org/reference/functions/antispambot/#comment-2779)
      * Filtering `widget_text` is no longer necessary as shortcodes are allowed in
        text widgets by default.
      * [Milana Cap](https://profiles.wordpress.org/milana_cap/) [8 years ago](https://developer.wordpress.org/reference/functions/antispambot/#comment-2780)
 12.  [Log in to add feedback](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%3Freplytocom%3D756%23feedback-editor-756)
 13.  [Skip to note 5 content](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#comment-content-7065)
 14.   [Nazrinn](https://profiles.wordpress.org/nazrinn/)  [  2 years ago  ](https://developer.wordpress.org/reference/functions/antispambot/#comment-7065)
 15. [You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%23comment-7065)
     Vote results for this note: 2[You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%23comment-7065)
 16. I really feel like this function should be updated. We’re in 2024 and [HTML entities can be easily decoded by spam bots](https://spencermortensen.com/articles/email-obfuscation/#text-entity:~:text=email%40example.com-,1.2,Entities,-Blocked%200%25%20of).
     At this point, this technique does not block spam at all.
 17. If you can, try to use [Xor](https://spencermortensen.com/articles/email-obfuscation/#text-xor:~:text=2.7%20Xor,JS)
     on your WordPress site; avoid using this function.
 18.  [Log in to add feedback](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%3Freplytocom%3D7065%23feedback-editor-7065)
 19.  [Skip to note 6 content](https://developer.wordpress.org/reference/functions/antispambot/?output_format=md#comment-content-7604)
 20.   [Rodrigo Vieira Eufrasio da Silva](https://profiles.wordpress.org/rodrigomct/)
     [  1 month ago  ](https://developer.wordpress.org/reference/functions/antispambot/#comment-7604)
 21. [You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%23comment-7604)
     Vote results for this note: 0[You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%23comment-7604)
 22. Fatal error risk without the `mbstring` extension
 23. Since WP 7.1 (see Changelog), `[antispambot()](https://developer.wordpress.org/reference/functions/antispambot/)`
     calls `mb_ord()` on every scanned character — not just multibyte ones. The `switch`
     branch that decides how to obfuscate each character is chosen at random, regardless
     of whether that character is multibyte.
 24. `mb_ord()` is provided by PHP’s `mbstring` extension. Unlike `mb_substr()` and`
     mb_strlen()`, WordPress does not ship a polyfill for it in `wp-includes/compat.
     php`. `mbstring` is only recommended for WordPress, not required — it’s disabled
     by default in PHP, and some hosts still don’t enable it.
 25. On a server without `mbstring`, any call to `[antispambot()](https://developer.wordpress.org/reference/functions/antispambot/)`
     has a random, per-character chance of throwing:
 26. Fatal error: Uncaught Error: Call to undefined function mb_ord()
 27. This can happen even for a plain ASCII email address, since the branch selection
     doesn’t check the character length first.
 28. If your theme/plugin needs to support hosts without `mbstring`, guard for it before
     calling the function:
 29. if ( ! function_exists( ‘mb_ord’ ) ) {
      // Provide a fallback obfuscation method,
     or skip [antispambot()](https://developer.wordpress.org/reference/functions/antispambot/)
     entirely. }
 30.  [Log in to add feedback](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F%3Freplytocom%3D7604%23feedback-editor-7604)

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fantispambot%2F)
before being able to contribute a note or feedback.