The customer-facing email on every page of leafclothing.co.uk is the literal placeholder string "[email protected]" in the raw HTML, because the address is wrapped in Cloudflare's email-obfuscation cipher and never decoded server-side.
- What I saw
- View source on the homepage, the contact page, and the testimonials page. Each one renders the email as <a class="__cf_email__" data-cfemail="056960646366696a716d6c6b62343c323d456268646c692b666a68">[email protected]</a>. The hex blob is XOR-encoded against the first byte and decodes to leafclothing1978@gmail.com. The decode only fires if Cloudflare's rocket-loader JavaScript reaches the browser and runs successfully. A visitor on an ad-blocker, a script-blocker, or a slow mobile connection where the script times out, will see "[email protected]" sitting on the page where the address should be. Google's indexers also never resolve the cipher, so search results for "leaf clothing newcastle email" surface third-party directory entries (Cylex, Yell, NewcastleGateshead) above the official site.
- Why it matters
- Email is the only inbound channel besides walking through the door and calling 0191 232 9083. When the address is invisible to search and broken on the page, a first-time visitor who wants to write about a wedding suit fitting, a stock query, or a press feature falls back to the phone or, more often, to nothing. The cipher was supposed to defeat scrapers; in practice it defeats actual customers.
- After rebuild
- The rebuild renders leafclothing1978@gmail.com as plain readable text inside a mailto link, plus a clean structured-data <a href="mailto:..."> the indexers can follow. Bot mail volume is handled in Gmail with a simple filter rather than by hiding the inbox from real people.