The email address was there, but AI assistants could not see it. Obfuscation hid it from anything that does not run JavaScript.
On our site the email address was there, written in the clear on every page. But an AI assistant opening the contact page could not find it.
Cloudflare's obfuscation hides the email address from anything that does not run JavaScript. With Email Address Obfuscation on, Cloudflare replaces the addresses in the HTML with «[email protected]» and restores them with a script in the browser, as its documentation explains.
AI assistant crawlers do not run JavaScript. Vercel measured it on about 1.3 billion requests in a month: none of the major AI crawlers, including those of OpenAI, Anthropic and Perplexity, runs the pages' JavaScript. They read the HTML as it arrives.
On 25 September 2026 the itria.io contact page, in the served code, contained no address. We fixed it by excluding the email address from obfuscation. In Itria's study of 121 food producer websites, 7 obfuscate it and 7 do not write it in the code at all.
This is a piece of Itria's lab: things measured on our own site, with the real numbers, to understand how search engines and assistants read it. The service that grows out of it is presence on search engines and AI assistants.
How Cloudflare's email obfuscation works
Cloudflare's Email Address Obfuscation protects email addresses from programs that harvest them to send spam. When it is on, Cloudflare rewrites every address it finds in the HTML into a link with the text «[email protected]», and adds a script that, in the browser, restores the real address.
«When Email Address Obfuscation is enabled, Cloudflare replaces visible email addresses in your HTML with links like [email protected].» (Cloudflare, Email Address Obfuscation documentation)
For a person with a browser nothing changes: the script runs and the email address appears. For a program that reads the HTML without running the script, the email address is not there. In its place it finds the text «[email protected]» and a link pointing to an internal Cloudflare path.
Why an AI assistant cannot see the obfuscated email address
AI assistants, when they read a page, take the HTML as the server delivers it. Vercel measured AI crawler traffic on its own network over a month, about 1.3 billion requests, and wrote that none of the major ones runs JavaScript: neither OpenAI's, including ChatGPT-User, nor ClaudeBot, nor PerplexityBot.
«none of the major AI crawlers currently render JavaScript» (Vercel, «The rise of the AI crawler», 17 December 2024)
The consequence is direct. Whoever asks an assistant «what is this company's email address» gets an answer built on the HTML it read: if the address is obfuscated there, the assistant does not find it, and answers with a form, a phone number, or nothing. Protection against spam becomes a barrier against whoever is trying to write.
| Who reads the page | Does it run JavaScript? | Does it see the obfuscated email address? |
|---|---|---|
| A person, with the browser | Yes. | Yes: the script restores it. |
| An AI assistant's crawler | No, according to Vercel's measurements. | No: it finds «[email protected]». |
| A program that reads the HTML, such as curl | No. | No: it is the way to check it yourself. |
Our case: the contact page without an email address
On 25 September 2026, in the site hygiene audit, we read the served HTML of the itria.io contact page the way an assistant reads it: no address, because obfuscation was on. The fix is the one Cloudflare itself documents: wrapping the address between two comments, email_off, which exclude it from obfuscation.
<!--email_off-->info@example.com<!--/email_off-->
Measured the same evening: the contact page contains the address in the clear twice, and no sign of obfuscation. It is a choice, not an oversight: exposing the email address makes it readable to programs that harvest addresses for spam too. For a contact address meant to be found, it pays off; for the site's other addresses it is decided case by case.
We are not alone: 14 sites out of 121
In Itria's study of the websites of 121 food producers listed in the ICE directory for foreign buyers, measured on 26 September 2026, 7 sites obfuscate the email address and another 7 do not write it in the code of the three pages read. For a buyer asking an assistant for a supplier's contact, 14 sites out of 121 have no email address to give.
The five-minute check, on your site
You read the contact page's HTML the way an assistant reads it, without JavaScript, and look for the at sign. If you get the text «email protected» or no address, for assistants the email address is not there. The command below does it from a terminal, on any site.
curl -s https://yoursite.com/contact | grep -o "[A-Za-z0-9._%+-]*@[A-Za-z0-9.-]*\.[a-z]*\|email-protection"
Questions and answers
Why can't ChatGPT or Claude find a website's email address?
Often because the email address is obfuscated. Cloudflare's Email Address Obfuscation replaces the addresses in the HTML with [email protected] and restores them with a script in the browser, and AI assistant crawlers do not run JavaScript.
Vercel measured it on about 1.3 billion requests: none of the major AI crawlers runs the pages' JavaScript.
How does Cloudflare's email obfuscation work?
When it is on, Cloudflare rewrites every email address in the HTML into a link with the text [email protected] and adds a script that, in the browser, restores the address. For a person nothing changes; for a program that does not run the script, the email address is not there.
It serves to protect addresses from programs that harvest them for spam.
How do you exclude an email address from Cloudflare's obfuscation?
By wrapping it between the email_off and /email_off comments in the page's HTML, as Cloudflare's documentation indicates. The address between the two comments stays in the clear.
It is a choice: the exposed address is also readable by programs that harvest addresses for spam, so it pays off for the contact address meant to be found.
How do you check whether your site's email address is readable by an AI assistant?
You read the contact page's HTML without running JavaScript, for example with curl, and look for an address with the at sign. If you get the text email protected or no address at all, for assistants the email address is not there.
It is the same way an AI assistant reads the page.
How many sites have an email address invisible to AI assistants?
In Itria's study of 121 food producer websites listed in the ICE directory for foreign buyers, measured on 26 September 2026, 7 obfuscate the email address and 7 do not write it in the code: 14 out of 121, 11.6%.
On Itria's own site the contact page contained no address in the served code, until the fix made the same day.
Notes on sources
- Cloudflare, Email Address Obfuscation: how obfuscation rewrites addresses and how they are excluded with email_off. The quotation in quotation marks is taken verbatim.
- Vercel, The rise of the AI crawler, 17 December 2024: about 1.3 billion AI crawler requests in a month on Vercel's network, and none of the major ones runs JavaScript. The quotation in quotation marks is taken verbatim.
- Itria's measurements: itria.io hygiene audit of 25 September 2026 and check on the same evening; study of the websites of 121 food producers in the ICE directory, measurements of 26 September 2026 (method and data).
Seeing your own site the way search engines and assistants read it.
An email address that is not in the code, an address that answers 200 where there is nothing: these are defects you cannot see from the browser. Write us a line about what weighs on you: we take the first step, even if we end up not working together.