Check ID: zone_email_obfuscation_enabled
Provider: Cloudflare
Service: zone
Severity: LOW
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Email Obfuscation (Scrape Shield) configuration by checking if it is enabled to protect email addresses on the website from automated harvesting by bots and spammers.

​
Risk

Without Email Obfuscation, email addresses displayed on your website can be harvested by bots.
  • Confidentiality: harvested emails become targets for spam and phishing campaigns
  • Integrity: employees may fall victim to targeted social engineering attacks
  • Availability: increased spam volume can overwhelm email systems

​
Recommendation

Enable Email Obfuscation as part of anti-scraping protections.
  • Automatically encodes email addresses to prevent bot harvesting
  • Email addresses remain visible and clickable for human visitors
  • Works with mailto: links and plain text email addresses
  • Part of the Scrape Shield feature set for comprehensive protection

​
Remediation

# Enable Email Obfuscation to protect against email harvesting
resource "cloudflare_zone_settings_override" "email_obfuscation" {
  zone_id = "<ZONE_ID>"
  settings {
    email_obfuscation = "on" # Critical: hides email addresses from automated scrapers
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_email_obfuscation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks