WhoKnew Shield™ - WordPress Email, Phone & Address Protection
⭐ Don't Just Hide Your Contacts — Trap Scrapers Automatically
WordPress Scraper Defense + Military-Grade Encryption
Stop spam calls, junk mail, and email harvesting with dual-layer obfuscation + active Scraper Trap™ honeypots.
Turn Protection Into Prevention
From hiding contact info → actively blocking scrapers. Military-grade encryption makes harvesting contacts from your WordPress site impossible. Hidden honeypots catch & block bots automatically.
Military-grade protection starts before encryption even enters the picture. Scrapers see a real-looking email or phone number — but it’s fake, and it poisons their database the moment they write it down. If a bot is smart enough to chase further, it hits a rotating cipher that requires a live API call. Two walls: the first poisons them, the second stops them cold. Every email, phone number, and address on your site is protected from the moment the page loads.
New Feature
Your contacts don’t have to exist on your site.
Military-grade encryption hides your contacts. Silent Contact™ removes them entirely. Emails, phone numbers, and addresses rendered as transparent PNG images — no text in your HTML, nothing for scrapers to find.
What scrapers see
<img src=“data:image/png;base64,iVBOR…”
alt=“” class=“wks-png-img” />
alt=“” class=“wks-png-img” />
What you see
Why We Built WhoKnew Shield™
“We were managing multiple WordPress sites — business sites, stores, portfolios. Contact forms and pages on every site. Then the spam started: 200+ emails per day, spam texts by the hour, constant robocalls, junk mail floods. We tried multiple obfuscation plugins — spent 8 hours adding shortcodes to hundreds of WordPress posts and pages. Two months later? Still getting spam. We’d missed several email addresses in old posts and widgets. That’s when we realized: manual WordPress shortcode plugins are fundamentally broken. You can’t protect 100% of contacts manually on a WordPress site — it’s impossible.
So we built WhoKnew Shield™: auto-detection that scans your entire WordPress site automatically, dual-layer protection that actually works, and Scraper Trap™ honeypots that catch and block bots immediately. Within 24 hours of activating Scraper Trap on our WordPress sites, we’d caught 47 scrapers and automatically blocked them all. Spam dropped to nearly zero within weeks.
Every WordPress site with contact info needs this. That’s why we made it.”
– J. Moody, Founder of WhoKnew™
Stop Spam at it's Source – Forever – Protect Your WordPress Site Now
More Than Contact Protection
Your Firewall
Never Saw
Them Coming.
Every automated attack starts with reconnaissance — scraping your site before it strikes. WhoKnew Shield™ catches bots before they finish step one, before any other security tool even knows there’s a threat.
01
Reconnaissance
🪤 Caught Here
🪤 Caught Here
Bot scrapes your entire site — harvesting emails, phone numbers, addresses, admin URLs, form endpoints, and plugin fingerprints. It ignores robots.txt. The honeytrap fires.
IP blocked immediately. The bot never gets to plan its attack. It’s done.
02
Mapping
🚫 Blocked
🚫 Blocked
Bot catalogs site structure, identifies technology stack, CMS version, and plugin vulnerabilities to plan its attack vector.
03
Attack
🚫 Never Happens
🚫 Never Happens
SQL injection, brute force login, credential stuffing, form spam — whatever the bot came to do. It never gets this far.
Live Production Data · Same Site · Same 30 Days
Wordfence
Industry-standard WordPress firewall
0
Blocks recorded
vs
WhoKnew Shield™
224 via Scraper Trap™ · 267 via Intelligence™ network
491+
Threats intercepted
Wordfence recorded zero attacks. Not because there were none — because Shield intercepted 491+ of them before Wordfence ever saw them: 224 caught directly by Scraper Trap™, plus 267 blocked by the WhoKnew Intelligence™ network.
The Complete Strategy
Three Steps. Full Coverage.
Any bot ignoring robots.txt gets blocked automatically
Repeat offenders are permanently banned after 2–3 hits
16+ million known bad IPs blocked before they ever knock
⚡ Live Proof
See Exactly What Bots See When They Crawl Your Site.
Our contact info is right on this page — visible to you, invisible to scrapers. Follow the steps below and see for yourself exactly what bots encounter when they try to harvest it.
Step 1
Right-click anywhere on this page
Select “View Page Source” from the menu — that shows the raw HTML exactly as bots and scrapers receive it. (Don’t use “Inspect” for this test — that shows the page after your browser has already decoded it.)
Step 2
Search the source code
Press Ctrl+F (Windows) or ⌘+F (Mac) to open the search box.
Ctrl
+
F
or
⌘
+
F
+
F
or
⌘
+
F
Step 3
Copy and paste this search term
Paste it into the search box and hit Enter. You’ll jump straight to our demo contact section.
Step 4
Now search for our actual contacts
Try searching for:
support@whoknew.io321-PLUGINS
You won’t find them. What you will find is a convincingly fake email address — something like c397b7d1@813e2a13.com — planted there deliberately. That fake address is what every scraper harvests and writes into their database as your real contact.
WHAT SCRAPERS ACTUALLY HARVEST FROM THE SOURCE
data-wks-type="email">c397b7d1@813e2a13.com
data-wks-type="phone">180d43da@ef28c6f0.comNow you’ve seen it with your own eyes.
What you just found in that source code is exactly what every scraper, harvesting bot, and spam tool collects on any page protected by WhoKnew Shield Pro.
They don’t leave empty-handed — they leave with fake data that poisons their own database. Real visitors see your contacts perfectly. Bots get played.
Defense architecture
Three independent layers
01
Advanced Encryption
Passive
Passive
Dynamic encryption generated specifically for your installation. Bots harvest convincing fake decoy data first — then hit an impenetrable wall of encryption if they try to go further. Visitors see your real contact info.
02
Scraper Trap™
Active
Active
Hidden honeypots catch bots the moment they probe your site. Blocked instantly, site-wide. You’re not just hiding — you’re fighting back.
03
Silent Contact™
★ New in V2
★ New in V2
Your contacts don’t exist as text anywhere in your HTML. No encoding to crack. Nothing to find. The ultimate layer.
Scraper Trap™ — Active Defense
Don’t Just Hide.
Fight Back.
Fight Back.
Most protection plugins are purely passive — they hide your contacts and hope for the best.
WhoKnew Shield™ Pro actively traps scrapers the moment they probe your site — then blocks them for as long as you choose.
Set your own block duration or make it permanent. No manual intervention. No IP lists to manage. Automatic, site-wide, instant.
47
Scrapers Caught
in the first 24 hours
What Happened When We Turned It On
When we activated Scraper Trap™ on our own sites, we caught 47 scrapers in the first 24 hours — all automatically blocked, site-wide, without touching a single setting. Spam dropped to nearly zero within weeks.
These weren’t edge cases. They were bots that had already been harvesting contact info from sites just like yours — and they walked straight into the trap. You choose how long they stay blocked — hours, days, or permanently. You’re in control.
How Scraper Trap™ Works
The Difference Between Passive and Active Protection
Every other obfuscation plugin hides your contacts and hopes bots give up. Scraper Trap™ doesn’t wait. The moment a bot touches a honeypot, it’s caught — and you decide how long it stays blocked. Combined with WhoKnew Intelligence™’s community blocklist of nearly 16+ million known bad actors, you’re not just defending. You’re winning before the fight even starts.
Plugin Features
Military-Grade Encryption
Encryption generated specifically for your installation — bots harvest fake decoy data in front of military-grade encryption
Scraper Trap™ Active Defense
Hidden WordPress honeypots catch and block scrapers automatically — stop them cold
Automatic IP Blocking
Caught scrapers get blocked from your entire site — instant ban
Zero-Migration WordPress Switching
Switch from other obfuscation plugins in seconds — no broken WordPress pages
Phone & Address Auto-Detection
Protects ALL contact types on WordPress automatically — not just emails like competitors
Blocked Scraper Dashboard
See every caught WordPress bot with IP, location, timestamp — full audit trail
100% WordPress Coverage
Auto-Detection Catches Everything Manual Shortcodes Miss — Zero Gaps on Your Site
Email Alerts & Geographic Tracking
Real-Time WordPress Threat Notifications — Know Where Attacks Come From
Click-to-Reveal Protection Buttons
Add an optional extra layer of protection with interactive buttons that hide contacts until clicked
How WhoKnew Shield™ Protects Your WordPress Site
Instant WordPress Protection
Easily activate WhoKnew Shield™ on your WordPress site to automatically protect all emails, phone numbers, and addresses with multi-layer obfuscation, creating immediate defense against spam bots and scrapers.
Free DownloadYour WordPress Contact Info Is Being Harvested
The Problem:
Every day, sophisticated bots scan millions of WordPress sites looking for exposed contact information. One unprotected email on your WordPress blog = 100+ spam messages per day. One exposed phone number on your WordPress business site = endless robocalls and SMS spam. One visible address on your WordPress portfolio = junk mail floods and potential identity theft.
Worse: manual WordPress shortcode plugins like Email Address Encoder and Neotrendy require you to wrap EVERY contact — miss just ONE in an old WordPress blog post, footer widget, or Elementor page builder section, and your entire protection strategy fails. Scrapers scan your WHOLE WordPress site for that one unprotected email. When they find it, they harvest everything.
How WhoKnew Shield™ Compares
Feature
Email Address Encoder
WhoKnew Shield FREE
WhoKnew Shield PRO
WordPress Compatible
✅ Yes
✅ Yes
✅ Yes
Protection Method
Single-layer entities
Dual-layer entities
Military-grade encryption
Email Protection
✅ Manual shortcodes
✅ Auto-detect
✅ Auto-detect
100% Coverage
❌ Easy to miss
✅ Auto-scan
✅ Auto-scan
Scraper Blocking
❌ None
❌ None
✅ Scraper Trap™
Phone Protection
❌ None
❌ None
✅ Auto-detect
Address Protection
❌ None
❌ None
✅ Auto-detect
Click-to-Reveal Buttons
❌ None
❌ None
✅ Optional
Not just a saying — research-backed
Competitors bypassed instantly.
Free adds an extra layer. Pro makes it impossible.
Independent research and scraper vendors agree: the protection most plugins use is broken by design. Here’s the difference.
What most plugins do
0%
Spam blocked (entity-based obfuscation in independent testing)
Overcome in seconds.
Most contact plugins (Email Address Encoder, Neotrendy, Encoder Bundle) use HTML entities or basic encoding. Scrapers decode them automatically — no special effort. Research and scraper vendors say it outright.
“HTML entities are often decoded automatically by server-side libraries, which means that even the most basic harvesters can get your email addresses without any special effort.”
— Spencer Mortensen, Email Obfuscation: What Works in 2026?
return base64_decode($encoded);One line of PHP. Scraper vendor’s published bypass — source.
Our free plugin
Dual Layer
2-Layers: HTML entities + CSS reversal · no one-line bypass
Dual-layer. Scraping gets hard.
Free uses the same encoding family as others (HTML entities) but adds an additional layer of CSS reversal — the contact is only revealed when the page is rendered with CSS. Simple entity decoders don’t get the real address without extra effort. That extra layer makes scraping harder than single-layer competitors.
Two layers. One step ahead of the rest.
Next level
Shield Pro
99.9%
Scraper blocking rate · contacts not in HTML
Makes scraping impossible.
Pro adds military-grade encryption, Silent Contact™, Scraper Trap™, and WhoKnew Intelligence™ — bots find convincing decoy data that poisons their database, and a rotating cipher that stops anyone who digs deeper. Your real contacts are never in the HTML. The target is constantly moving. There is no path to your contact.
Includes Scraper Trap™, our active bot defense layer that catches scrapers as they crawl, & WhoKnew Intelligence™ – with over 16+ million known crawlers already blocked network-wide.
Independent research: Spencer Mortensen, Email Obfuscation: What Works in 2026? · Scraper vendor bypass: Google Maps Email Extractor.
Interactive decoder
See how each method works
Pick a button below to watch how scrapers see each approach — and why only Pro makes it impossible.
Decodes to: c1ee1ea6@a19b360f.com — one line of PHP. Your real address, in their database in seconds.
One line of PHP. Scrapers decode this automatically — no special effort.
In HTML
bW9jLmVscG1heGVAdGNhdG5vYw==
bW9jLmVscG1heGVAdGNhdG5vYw==
↓ Same decode
Scraper gets
moc.elpmaxe@tcatnoc
moc.elpmaxe@tcatnoc
That’s the backwards address they store. Human sees (CSS): c1ee1ea6@a19b360f.com — so it poisons their database; mail to that string never reaches you.
Dual layer: We store the reversed version in the markup. They decode and get the gibberish above. Fixing it would require manual correction or a new script to detect and reverse our layer — possible, but not as trivial as the one-line decode.
In HTML
data-wks-id=”3f9a2c1bd4e8f7a2c6b0e3d5a1f9c8b4″
data-wks-id=”3f9a2c1bd4e8f7a2c6b0e3d5a1f9c8b4″
↓ Even if they find the API endpoint
They receive
PioATsiV9JjMLsOoDiwLz+HgsPPER5Nc4q2CLJfT9Ak=
PioATsiV9JjMLsOoDiwLz+HgsPPER5Nc4q2CLJfT9Ak=
↓ Key rotates every 5 min · rate limited · JS-only
Result
Wrong email stored. Real one: unreachable.
Wrong email stored. Real one: unreachable.
No email string exists in the HTML at all. Scrapers store the fake address and poison their own database. The real contact is encrypted behind a rotating key that only exists for 5 minutes — in the browser, not the page.
Pro: Three layers — no text to harvest, a fake address to poison their list, and an encrypted blob that requires a live browser session and a rotating key to decrypt. There is no offline attack path.
Scraper sees
89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52… (PNG image bytes)
89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52… (PNG image bytes)
↓ Try to “decrypt”
Result
Nothing to decrypt — no email string exists.
Nothing to decrypt — no email string exists.
That doesn’t even look like an email. It’s not — it’s raw image bytes. No string to decode or decrypt. The whole thing is futile.
Silent Contact™: Your address is drawn as a PNG (with OCR resistance). No text in the DOM. Any attempt to “decrypt” just hits raw pixel data.
Protect. Trap. Block.
Pro adds military-grade encryption, Scraper Trap™ honeypots, and phone/address auto-detection to catch and block WordPress scrapers permanently.
2 Months Free!
Basic
Free
- Dual-Layer Protection
- Email Auto-Detection
- Competitor Shortcuts
- All WordPress Themes
- Click-to-Reveal Options
- Community Support
- Unlimited Sites
- Forever Free
Pro Licence
$8/ month
- Everything in Basic
- Military-Grade Encryption
- Phone & Address Auto-Detection
- Silent Contact™
(PNG’s with OCR resistance) - Scraper Trap™ Defense
- WhoKnew Intelligence™
(Threat Intelligence Network) - Automatic IP Blocking
- Email Threat Alerts
- Blocked Scraper Dashboard
- Locked Encryption
- Priority Support
1 Site Licence
14-Day Guarantee
Growth Licence
$16/ month
- Everything in Basic
- Everything in Pro
- 33% Discount off Pro
- Priority Tech Support
3 Site Licences
14-Day Guarantee
Agency Licence
$40/ month
- Everything in Basic
- Everything in Pro
- 50% Discount off Pro
- Priority Tech Support
10 Site Licences
14-Day Guarantee
Basic
Free
- Dual-Layer Protection
- Email Auto-Detection
- Competitor Shortcuts
- All WordPress Themes
- Click-to-Reveal Options
- Community Support
- Unlimited Sites
- Forever Free
Pro Licence
$80/ year
- Everything in Basic
- Military-Grade Encryption
- Phone & Address Auto-Detection
- Silent Contact™
(PNG’s with OCR resistance) - Scraper Trap™ Defense
- WhoKnew Intelligence™
(Threat Intelligence Network) - Automatic IP Blocking
- Email Threat Alerts
- Blocked Scraper Dashboard
- Locked Encryption
- Priority Support
1 Site Licence
14-Day Guarantee
Growth Licence
$160/ year
- Everything in Basic
- Everything in Pro
- 33% Discount off Pro
- Priority Tech Support
3 Site Licences
14-Day Guarantee
Agency Licence
$400/ year
- Everything in Basic
- Everything in Pro
- 50% Discount off Pro
- Priority Tech Support
10 Site Licences
14-Day Guarantee
Multiple WordPress Sites?
Need Staging or Client Sites?
Pro works on one site. Growth includes 3 licenses, Agency includes 10 — ideal for development environments or managing client sites.
Protect Your Inbox
Download WhoKnew Shield™ and stop scrapers from harvesting your contacts — permanently.
Get Pro for $80/YearDownload Free*Learn More About
WhoKnew Intelligence™
Effortless Plugin Migration
No broken pages. Just better protection.
Already using Email Address Encoder, Email Address Obfuscation, Email Encoder Bundle, or Antispambot on your WordPress site? Switch to better protection in 30 seconds.
Migration Steps
Activate WhoKnew Shield on your WordPress site
⚡ 30 seconds.
01
Deactivate your old Email Address Encoder
🔄 5 seconds.
02
Done – All shortcodes work with better protection
🛡️ No downtime. Zero exposure.
03
Before WhoKnew Shield™
Manual shortcodes are tedious, but more importantly — miss just ONE email in an old WordPress post and your entire protection fails. Scrapers find that one unprotected contact, and the spam begins.
With WhoKnew Shield™
WhoKnew Shield™ scans your entire WordPress site automatically — posts, pages, widgets, page builders — and protects 100% of contacts with military-grade encryption. Scraper Trap catches and blocks bots before they can steal anything.
Frequently Asked Questions
How does the plugin work?
WhoKnew Shield automatically detects and protects all emails, phones, and addresses using dual-layer obfuscation (FREE) or military-grade encryption (PRO). Unlike manual shortcode plugins, auto-detection scans your entire WordPress site ensuring 100% coverage with zero edits needed.
What’s included in the Pro version?
Pro unlocks military-grade encryption, phone & address auto-detection, Scraper Trap™ honeypots, automatic IP blocking, email threat alerts, and blocked scraper dashboard. Everything you need to stop spam calls, junk mail, and email harvesting.
Is it easy to set up?
Yes! Download from WordPress.org, install, enable auto-detection, and you're protected in minutes. No coding required, works with all WordPress themes and page builders. Simple one-page settings panel with test tool.
Do you offer support?
Absolutely! Everyone can get instant support through our AI chat assistant "Who the Owl", right here. Free users also have access to WordPress.org community support, while Pro users enjoy priority ticketed support for more complex issues.
Does this slow down my site?
No. WhoKnew Shield is lightweight and optimized for WordPress performance. Works seamlessly with all caching plugins. Zero PageSpeed impact — your site stays fast while staying protected.
What happens if my subscription expires?
Your site continues working with FREE-level protection (dual-layer email protection). Pro features deactivate until renewal. Already-blocked scrapers stay blocked. No downtime, no broken pages.
Why is 100% contact coverage so critical for WordPress sites?
Because scrapers are thorough. Miss just ONE unprotected email in an old post and bots find it, then systematically scrape everything. Manual shortcode plugins make this inevitable on sites with 200+ posts. Shield's auto-detection scans your ENTIRE site automatically — old posts, widgets, page builders, everything. Set once, protect forever.
Does WhoKnew Shield™ actually stop spam on WordPress sites?
Yes. Dual-layer protection blocks 95%+ of scrapers, military-grade encryption stops 99.9%, and Scraper Trap catches the rest. Most users see a significant reduction in spam within the first few months. Run your own test for 14 days risk-free.
Does it work even if I don't expose any contact info?
Yes. The Scraper Trap™ honeypots catch and block bots regardless of what they'd find on your site. Even if you use contact forms only and expose nothing intentionally, chances are there's a contact somewhere you've forgotten about — a client's email address dropped into a blog post three years ago, a phone number in an old widget, a supplier's address buried in a case study. Bots find these. Shield's auto-detection finds them first and protects them automatically. And even on a site with genuinely nothing to harvest, the trap still catches bots crawling your source code and probing for vulnerabilities — and the dashboard shows you exactly what's been hitting your site. Most site owners with "clean" setups are shocked by what they see.
Will the Scraper Trap™ ever block a real visitor by mistake?
Almost never in normal use — and here's why. The honeypot elements are completely invisible to real visitors. They don't render on screen, don't appear in any navigation, and there's no scenario where a human browsing your site would ever encounter them. Only an automated crawler reading your raw HTML line by line will find them. The one exception is during testing — if you or a developer are crawling your own site with a scraping tool to audit it, that tool may trigger the trap. If that happens, you can whitelist your own IP directly from the Shield dashboard and you're unblocked immediately. Outside of that scenario, if the trap fires, it was a bot.
How is this different from other firewall & obfuscation WordPress plugins?
Most security plugins like Wordfence are built to catch Phase 3 attacks — SQL injection, brute force, known malware. They never see the bot that quietly crawled your site first and left with your contacts. WhoKnew Shield PRO is built for Phase 1 — the reconnaissance stage every other tool misses. Scraper Trap™ catches bots the moment they probe your source code; military-grade encryption means that even if a bot slips through with fake decoy data, the real contact is still behind a rotating cipher they can't crack; and auto-detection covers your entire site automatically with zero gaps. Competitors hide contacts and hope for the best. Shield catches the bots doing the harvesting.
Can I try it risk-free?
Yes. Shield FREE is 100% free forever from WordPress.org. For Pro features — military-grade encryption, Scraper Trap™, phone and address protection, and WhoKnew Intelligence™ community threat network — we offer a 14-day money-back guarantee. No questions asked.
Global Protection
Global Address Detection. Built In.
WhoKnew Shield™ Pro detects and protects physical addresses written in 18 languages natively — no configuration, no extra plugins, no manual tagging. Whether your site serves customers in São Paulo, Seoul, or Riyadh, address auto-detection works out of the box.
Supported languages include English (full USPS standard), French (France, Belgium, Switzerland, Canada), Spanish (Spain and Latin America), German (Germany, Austria, Switzerland), Italian (including Venice and Rome-specific address formats), Portuguese (Brazil and Portugal), Dutch (Netherlands and Flemish Belgium), Russian, Ukrainian, Polish, Romanian, Turkish, Greek (Greece and Cyprus), Arabic (Egypt, Saudi Arabia, UAE, Jordan, Lebanon, Morocco, and more), Chinese (Simplified and Traditional — Mainland, Taiwan, Hong Kong, Macau), Japanese, Korean, and Icelandic.
Both native scripts and romanised transliterations are detected automatically — so an Arabic address written in Arabic script and one written in roman characters are both caught and protected.
🇺🇸
English (US)
English (US)
🇫🇷
French
French
🇪🇸
Spanish
Spanish
🇩🇪
German
German
🇮🇹
Italian
Italian
🇧🇷
Portuguese
Portuguese
🇳🇱
Dutch
Dutch
🇷🇺
Russian
Russian
🇺🇦
Ukrainian
Ukrainian
🇵🇱
Polish
Polish
🇷🇴
Romanian
Romanian
🇹🇷
Turkish
Turkish
🇬🇷
Greek
Greek
🇸🇦
Arabic
Arabic
🇨🇳
Chinese
Chinese
🇯🇵
Japanese
Japanese
🇰🇷
Korean
Korean
🇮🇸
Icelandic
Icelandic
Stop WordPress Spam Forever
Every day without WhoKnew Shield™, bots harvest your contact info.
Stop spam calls, junk mail, & email floods.
14
Day Guarantee
Try Pro. Protect your contacts from scrapers. Change how you run your site — or get every dollar back.
Activate Pro, watch phone numbers, emails, and addresses get military-grade encryption and click-to-reveal. Turn on Scraper Trap™ and catch bots automatically. Not convinced in 14 days? Full refund. Zero questions. The only risk is leaving your contact info exposed.
Stop exposing.
Start protecting.
Win.
WhoKnew Shield Pro + Scraper Trap™ — the only WordPress plugin built to encrypt contact info and block scrapers at the same time.
14-day money-back guarantee
Military-grade encryption from day one
Zero PageSpeed impact
Works on all WordPress themes
Military-grade encryption from day one
Zero PageSpeed impact
Works on all WordPress themes
