For years I treated spam as an inbox problem: better filters, more rules, empty the junk folder every couple of days. It never got better, and I never asked why.

Then I wrote the other side of it — a small crawler that reads a website exactly the way an address harvester does. Not a scanner in the security sense: it just downloads public pages and looks at what's sitting there in plain markup.

I pointed it at my own site first. Three addresses I'd completely forgotten about, one of them in a footer that shipped on \~300 pages.

A few things I learned building it:

* **The "obfuscation" tricks are dead.** `name (at) domain (dot) com`, HTML entities, `[at]`, spelled-out variants — I ended up matching 16 common disguises in an afternoon, with regex. Anyone selling this as protection in 2026 is selling nostalgia.
* **Screen readers leak too.** My address was drawn as vectors so bots couldn't read it — but the `aria-label` politely said "name at domain dot com". My own tool found it. Accessible name now describes the *action* ("Email us"), not the destination.
* **Half the exposure isn't even on the site.** `info@`, `office@`, `contact@` get tried against every domain automatically. They're guessed from the domain name, so removing them from your pages does nothing — you have to retire the mailbox.
* **Unguarded contact forms are a spam source, not just a spam target.** A form with no bot check can be POSTed a thousand times a night, and every one of those lands in a real inbox. Some of the weird "offers" you get come through your own form.

On my own site: days that used to bring up to 20 spam messages have had **zero bot-sent mail since August 6th**. Not zero mail — the occasional hand-typed one still gets through, and nothing stops those. But the machines are gone, and I stopped emptying a junk folder.

One design decision I want to flag, because it's the whole reason the tool works the way it does: **it never shows you the addresses on screen.** You get the count and an exposure score; the actual list goes only to the email address that asked for it. Otherwise I'd have built a very convenient harvester with a nice UI, which is exactly the thing the tool argues against.

It's free, no account, and it reads up to 40 public pages. Curious what it finds on yours — and genuinely interested if anyone has a case it misses (it can't read PDFs or JS-built addresses, which are both deliberate blind spots).

[https://cittago.com/tools/email-exposure/](https://cittago.com/tools/email-exposure/)

How many email addresses can a bot take from your site?