What the check looks at
D2 reads the HTML of your home page as an anonymous visitor gets it and looks for the decode script (/cdn-cgi/scripts/ with email-decode.min.js) or the data-cfemail attribute on an element. It also notes whether the page uses <template> elements.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | Email Obfuscation is off Your pages show email addresses as they are written. |
| InfoConfidence: High | Email Obfuscation is rewriting addresses Cloudflare hides addresses from scrapers. Nothing is wrong, but it rewrites the page. With template elements on the page, the result adds that an address inside them may still be shown in full. |
| Could not checkConfidence: Medium | This check could not be completed The home page is the WooCommerce Coming soon page ( maintenance). |
| Could not checkConfidence: Low | This check could not be completed The home page could not be read. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
maintenance: The site is in maintenance mode or behind a coming soon page, so the pages read were not the real ones.loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- Addresses appear as [email protected] where the decode script cannot run, for example in some feed readers or tools that read the HTML.
- An address used by a script or a form does not work as expected.
Why it happens
Email Address Obfuscation replaces visible addresses in the HTML with links and adds a small decode script (Cloudflare: Email Address Obfuscation). Cloudflare lists where it does not apply (tag attributes other than href of a link, script, noscript, textarea, head, pages sent with Cache-Control: no-transform) and says it might not work as expected with <template> tags.
Confirm it by hand
curl -s "https://example.com/" | grep -oE "email-decode.min.js|data-cfemail" | sort -uHow to fix it
This is an Info result: change something only if obfuscation gets in your way.
In Cloudflare: turn it off for the zone.
In WordPress: or exclude a single address in your template or content:
<!--email_off-->contact@example.com<!--/email_off-->Limitations
Only the home page is read. A page with addresses inside template elements elsewhere is not seen.
Related checks
- D1 Rocket Loader: the other Cloudflare feature that rewrites your HTML.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.