Back to Checks
cloudflare

Email Obfuscation is enabled

zone_email_obfuscation_enabled
Service: zoneSeverity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for Email Obfuscation (Scrape Shield) configuration by checking if it is enabled to protect email addresses on the website from automated harvesting by bots and spammers.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without Email Obfuscation, email addresses displayed on your website can be harvested by bots.

  • Confidentiality: harvested emails become targets for spam and phishing campaigns
  • Integrity: employees may fall victim to targeted social engineering attacks
  • Availability: increased spam volume can overwhelm email systems

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_email_obfuscation_enabled

Recommendation

Enable Email Obfuscation as part of anti-scraping protections.

  • Automatically encodes email addresses to prevent bot harvesting
  • Email addresses remain visible and clickable for human visitors
  • Works with mailto: links and plain text email addresses
  • Part of the Scrape Shield feature set for comprehensive protection

Remediation

Terraform

# Enable Email Obfuscation to protect against email harvesting
resource "cloudflare_zone_settings_override" "email_obfuscation" {
  zone_id = "<ZONE_ID>"
  settings {
    email_obfuscation = "on" # Critical: hides email addresses from automated scrapers
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Scrape Shield (or Security > Settings in newer UI)
3Scroll to Email Address Obfuscation
4Toggle the setting to On
5Verify that email addresses still work correctly for human visitors

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_email_obfuscation_enabled(Check):
    """Ensure that Email Obfuscation is enabled for Cloudflare zones.

    Email Obfuscation is part of Cloudflare's Scrape Shield suite that protects
    email addresses displayed on websites from automated harvesting by bots and
    spammers. It encrypts email addresses in the HTML source while keeping them
    visible to human visitors, reducing spam and protecting user privacy.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Email Obfuscation enabled check.

        Iterates through all Cloudflare zones and verifies that Email Obfuscation
        is enabled. This feature helps prevent email harvesting by obfuscating
        email addresses in the page source.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Email
            Obfuscation is enabled, or FAIL status if it is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            email_obfuscation = (zone.settings.email_obfuscation or "").lower()
            if email_obfuscation == "on":
                report.status = "PASS"
                report.status_extended = (
                    f"Email Obfuscation is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Email Obfuscation is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References