How to Use Email and Phone Protection in WordPress

What Is the Email and Phone Protection feature?

Email addresses and phone numbers in your WordPress content are vulnerable to automated harvesting. Bots scan pages, extract email addresses and phone numbers, and add them to spam lists or sell them to marketers.

The Email and Phone Protection feature cloaks these addresses in your content, making them invisible to bots but visible to real users. The feature works on all post types, pages, comments, and widgets.

Why You Need It

Public email addresses and phone numbers are at constant risk:

• Spam bots: Scan the web for email addresses to add to spam lists
• Robocallers: Harvest phone numbers for telemarketing
• Data brokers: Compile databases of personal information
• Phishing: Use harvested emails to send targeted phishing attacks

Cloaking your contact information is a critical privacy measure.

How to Use Email and Phone Protection in WordPress

Step 1: Navigate to Settings

Click into the Classic Monks plugin settings in your WordPress dashboard.

Step 2: Go to the Security Tab

Click on the Security menu, then click the WP Protection subtab.

Step 3: Enable Email and Phone Protection

Scroll to Email and Phone Protection and toggle on. Nested options expand.

Step 4: Enable Auto-Detect (Recommended)

Toggle on Auto-Detect Phone Numbers to automatically scan your content and apply protection to any email or phone number it finds.

Step 5: Configure the Scope

Set the Email Protection Scope:

• All Content: Apply to posts, pages, custom post types, comments, widgets
• Posts and Pages Only: Apply only to post content (not comments or widgets)
• Custom: Use the filter to specify your own scope

Step 6: Configure the Method

Set the Email Protection Method:

• JavaScript Cloaking: Render emails as JavaScript (most secure, slight rendering delay)
• CSS Cloaking: Use CSS to hide emails (works without JavaScript, less secure)
• Text Replacement: Replace @ with [at] and . with [dot] (most compatible, looks ugly)

Step 7: Configure the Class (Advanced)

If you want to add a custom CSS class to cloaked elements, set the Email Protection Class field. This is useful for theme-specific styling.

Step 8: Save Changes

Click Save Changes.

Step 9: Test

View a page or post that contains an email address. The email should be cloaked (visible to humans, not to bots).

Configuration Options

Option	Description	Default
Email and Phone Protection	Master toggle.	Off
Auto-Detect Phone Numbers	Automatically find and protect phone numbers.	Off
Email Protection Scope	Where to apply protection.	All Content
Email Protection Method	How to cloak the addresses.	JavaScript
Email Protection Class	Custom CSS class for cloaked elements.	(empty)

What Gets Affected

• The post content: emails and phone numbers are cloaked
• The page content: emails and phone numbers are cloaked
• The custom post type content: emails and phone numbers are cloaked
• The comments: emails are cloaked (if “All Content” scope)
• The widgets: emails are cloaked (if “All Content” scope)
• The rendered HTML: emails appear as cloaked elements to bots

What Does NOT Get Affected

• The admin (the post editor still shows the original email)
• The user experience: real users see the email as normal (with JavaScript)
• The email functionality: clicking the email still opens the mail client
• The phone functionality: clicking the phone number on mobile still initiates a call
• Search engines: Google can still read the cloaked emails (uses JavaScript)

Advanced Options (Developers)

This feature registers 4 WordPress hooks in email-phone-protection.php:

Actions:

• template_redirect calls cm_email_protection_start_buffer() (Starts output buffering for email filtering (priority 1))
• wp_enqueue_scripts calls cm_email_protection_enqueue_assets() (Enqueues email protection JS/CSS)
• init calls cm_email_protection_init() (Initializes email protection (priority 100))

Filters:

• cm_email_protection_filter_hooks calls apply_filters() (Customizable filter)

// Hooked in email-phone-protection.php
add_action( 'template_redirect', 'cm_email_protection_start_buffer' );

The feature modifies WordPress behavior by registering or removing hooks. Disabling it reverses those changes and WordPress returns to its default behavior.