Find the Hidden Email: Reading a Contact Link From View Source
The challenge
This personal profile page says 'contact me' but never prints an email address on screen. The real address is still in the page, set up as an invisible contact link. Open View source, find it, and submit the person's email.
What you'll learn
- Open a profile page's View source to read what it really contains
- Understand that a 'contact me' page can carry an email without showing it
- Recognise a mailto contact link and read the address inside it
- Find a link that was set to stay invisible in the HTML
- Explain why hiding an address from the screen does not keep it private
Skills tested
Prerequisites
- Knowing how to open View source in a browser
- Recognising the shape of an email address
How it works
People who do not want their email scraped sometimes avoid printing it on the page, hoping that what you cannot see cannot be collected. A common version of this is to keep a working contact link in the page but mark it invisible, so a script could still use it while a casual visitor never sees the address.
The problem is that the link is still in the HTML the server sends to your browser. Opening View source shows it plainly. Email links use a special form, mailto:, followed by the address - here mailto:[email protected]. Even though the browser was told not to draw this link, the address is right there in the page text for anyone to read.
This is the gentlest example of a rule that holds everywhere: anything the page is built from travels to the visitor and can be read. Hiding it on screen is a display choice, not protection. For gathering information about a person or a site, View source is one of the first and simplest places to look.
Common mistakes
- Believing there is no email. Reading "contact me" with no visible address and assuming the page does not contain one.
- Only checking the visible links. Reading the portfolio and Instagram links but missing the contact link that was set to be invisible.
- Submitting the wrong part. Typing the link text ("email Jordan") or including the
mailto:prefix instead of the bare address. - Assuming hidden means safe. Treating an invisible link as if it were not delivered to the browser.
How to defend against it
If an address must stay reachable for real contacts but resist easy harvesting, hiding it on screen is not the answer - it is in the page either way. Use approaches that keep the address off the client entirely.
- Replace a published address with a contact form that posts to the server, so the address never ships to the browser.
- Do not keep a working
mailto:link in the HTML if you do not want the address collected. - Accept that any email placed in a public page is effectively public, hidden or not.
- Use a dedicated, throwaway, or aliased address for public profiles when harvesting is a concern.