[Feature Request]: Email obfuscation to protect against spam bots

[mathieumaf]

Is your feature request related to a problem? Please describe.
Email addresses displayed on AstroPaper sites (e.g. in the social links) are exposed as plain text in the HTML source. Spam bots can easily scrape them, leading to unwanted spam for site owners.

Describe the solution you'd like
A built-in email obfuscation mechanism using XOR encoding — the same technique Cloudflare uses for its Email Address Obfuscation feature. It would work in three parts:

1. A utility function that XOR-encodes the email at build time into a hex string (random key + encoded characters)
2. A rehype plugin that automatically transforms mailto: links in Markdown content — replacing the href with # and storing the encoded email in a data-encoded-email attribute
3. A small inline client-side script (~15 lines) that decodes and restores the mailto: links on page load

This way, the raw email never appears in the static HTML. Only users with JavaScript enabled (i.e. real visitors, not most bots) can see and click the email link.

Describe alternatives you've considered

• HTML entities encoding (mai...): too weak — most HTML parsers decode them automatically, so bots can still read the email
• CSS direction: rtl with reversed text: breaks copy-paste and accessibility, and doesn't protect the href attribute
• Rendering email as an image: not clickable, not accessible, poor UX
• Contact form instead of email link: effective but out of scope for a static template and requires a backend service

XOR encoding offers the best trade-off between protection, simplicity, and user experience.

Additional context
I have implemented this approach on my own AstroPaper-based site and it works well. The implementation is lightweight and non-breaking. Cloudflare's production use of the same technique validates its effectiveness against the vast majority of email scrapers.

A reference implementation could include:

• An encodeEmail() utility for build-time encoding
• A rehypeObfuscateEmail plugin for automatic Markdown mailto: link transformation
• An ObfuscatedMailLink Astro component for use in templates (e.g. Socials.astro)
• A decoder script in the base layout

I'd be happy to open a PR with this implementation if there's interest.

[jasontally]

Probably obvious already but you could just run your AstroPaper site on Cloudflare and enable Cloudflare's feature that you mention. It's free and they will even run the build on their infrastructure too if you put it in a private (or public) GitHub or gitlab repository.

[mathieumaf]

Thanks for the suggestion! You're right, Cloudflare's Email Address Obfuscation works great.

However, not everyone deploys on Cloudflare. AstroPaper sites can be hosted on Vercel, Netlify, GitHub Pages, or any static hosting provider. A built-in solution would protect email addresses regardless of where the site is deployed, without relying on an external service.

It also keeps the template self-contained, which aligns with the spirit of a static site — no dependency on a specific hosting provider for a basic privacy feature.

That said, this could definitely be an opt-in feature — disabled by default, with a simple flag in the site config to enable it. That way it doesn't add any overhead for users who don't need it or already rely on Cloudflare.