A site needed a working contact address on it, publicly, because a payment provider wanted to see one before approving the account. We added it, checked the page in a browser, and there it was.
Then we fetched the same page the way a script would, and the address was gone. In its place was a placeholder, and the clickable mail link had vanished entirely.
What was doing it
The hosting platform has a feature that hides email addresses from the programs that harvest them for spam lists. It replaces the address with a token and adds a small piece of script that puts the real one back once a browser loads it.
It works. It is on by default, which is a sensible default. And for its actual purpose it was doing exactly the right thing.
The problem is that a compliance reviewer checking whether a site lists a contact address is, from the page's point of view, indistinguishable from a harvester. So is a search engine, an archive, an accessibility tool, and anyone whose browser did not run the script.
A protection with no blast radius is rare. This one hid the detail from everyone who was not a person.
The shape of it
Protective features work by removing something. The question is always who else loses it:
- An aggressive spam filter that also eats the password reset emails your customers asked for.
- A firewall rule that blocks a scraper and your own payment provider's callback with it.
- A consent banner that stops analytics and the thing that records whether checkout worked.
- A permission tightened so a department cannot export data, and the overnight report cannot either.
- Rate limiting that stops abuse and your own integration at month end.
What we did
Not turn it off. The platform has a documented way to exempt one section, so the four pages that must carry a readable address do, and every other address on the site keeps the protection.
- When you turn a protection on, name who is supposed to lose access and check nobody else did.
- Test as the party that matters, with their tools. A browser is a generous reader; a reviewer's fetch is not.
- Prefer the narrow exemption to switching the feature off. Most platforms have one, and most people do not look.
- Re-check after enabling anything protective. The failure shows up somewhere you were not watching, usually weeks later.
The thing that makes this class expensive is that it looks fine from the inside. We only caught it because we fetched our own page the way a stranger would.