Direct Email Exposure vs. Form Relays: A Security Deep Dive


Why the old “mailto:” approach is a liability

When you paste a raw email address on a webpage, you’re essentially putting a neon sign in front of spammers, bots, and data‑harvesting crawlers.

Risk What happens Real‑world impact
Spam flood Web scrapers collect mailto: links and feed them to bulk‑mail services. Inbox overflow, wasted time, potential account bans.
Phishing opportunities Attackers harvest addresses to craft targeted phishing emails. Compromised credentials, brand damage.
Data leakage Publicly exposed contact details violate privacy policies (GDPR, CCPA). Legal penalties, loss of trust.
Credential stuffing Hackers pair email addresses with leaked password dumps. Account takeover.

Even if you obfuscate the address with JavaScript or CSS, determined bots can still decode it. The safest route is never to expose the address at all—let a server handle the communication instead.


Form relays: the modern, secure alternative

A form relay is a tiny web service that receives a visitor’s message, forwards it to your inbox, and never reveals your real address. The user sees a clean, simple link, while the backend does the heavy lifting.

Enter formcrab.com – Receive Messages, Hide Your Email

  • Zero code required – just paste a private link wherever you want.
  • Built‑in anti‑spam protection – we filter bots before they reach your inbox.
  • Invisible to crawlers – no mailto: links, no email address in the HTML.
  • Works everywhere – perfect for GitHub READMEs, Twitter bios, static blogs, or any place you can share a URL.
  • Full control – we host the landing page, the form, and the backend, so you never pay for hosting or worry about maintenance.

“Stop putting your raw email on websites. Get a private link, share it anywhere, and receive messages directly in your inbox.”formcrab.com


How it works under the hood

  1. Create a private token on formcrab.com – this becomes your unique endpoint.
  2. Share the link (https://formcrab.com/f/{your‑token}) wherever you need contact.
  3. A visitor clicks the link, fills a tiny form, and hits Send.
  4. Formcrab forwards the content to your real email address, hides the sender’s IP (optional), and returns a “Thank you” page.

Because the email address never appears in the page source, bots can’t scrape it. The only piece of data visible to the internet is the token, which is useless without the backend.


Customizing the experience with GET parameters

Formcrab lets you tailor the form on‑the‑fly. Append query strings to your private link to pre‑fill fields, set a subject line, or redirect users after submission. Replace {custom-link} with your own token.

1. Auto‑fill Name

<a href="https://formcrab.com/f/{custom-link}?name=Hugh" target="_blank">Email us</a>

If you already know the user’s name, the name parameter saves them a keystroke.

2. Pre‑set Visitor Email

<a href="https://formcrab.com/f/{custom-link}[email protected]" target="_blank">Contact Support</a>

Great for personalized outreach where the recipient’s address is known in advance.

3. Custom Subject

<a href="https://formcrab.com/f/{custom-link}?subject=Urgent+Support+Request" target="_blank">Report an Issue</a>

Your inbox will show the subject you defined, helping you prioritize tickets.

4. Predefined Message

<a href="https://formcrab.com/f/{custom-link}?message=I+would+like+to+request+a+demo" target="_blank">Inquiry</a>

Provide a starter text that guides the user or captures essential details upfront.

5. Custom Redirect (Next)

<a href="https://formcrab.com/f/{custom-link}?next=https://yoursite.com/success" target="_blank">Send and Return</a>

Override the default “Thank You” page with your own success page, preserving brand consistency.


Real‑world use cases

Scenario Why form relay shines
Open‑source project maintainers List https://formcrab.com/f/xyz in the README. Contributors can report bugs without exposing the maintainer’s email.
Freelancers on Twitter Replace a raw address in your bio with a single link. You keep inbox tidy and avoid spam.
Static sites on Netlify or GitHub Pages No server‑side code needed; the form works out‑of‑the‑box.
Event sign‑up pages Pre‑fill event name via subject or message to collect consistent RSVPs.
Customer support for small SaaS Use next to send users back to a knowledge‑base article after they submit a ticket.

Bottom line: hide the email, protect the inbox

Directly publishing an email address is a legacy practice that no longer makes sense in an era of automated scrapers. Form relays like formcrab.com give you the same reach with dramatically stronger security, zero maintenance overhead, and a suite of easy customizations.

Take the first step: generate a private link on formcrab.com, replace the raw mailto: everywhere you currently expose your address, and let the platform handle the rest. Your inbox—and your sanity—will thank you.

Ready to build your own forms?

Start receiving submissions today without worrying about email exposure or complex backends.

Create Your Private Link
Back to all articles