Click to return to home page
Richard Lowe Jr Home

Avoid mailto

Virtually every web site on the internet needs to get some kind of data from their visitors. Now most webmasters who need to get orders will use some kind of shopping cart. If a guestbook must be signed, then a guestbook form is used (often from a "free" service).

Many webmasters also want to allow their visitors to send them general comments and questions. It's very common, unfortunately, for those webmasters to take a shortcut and embed the "mailto" within their web pages.

Yes, mailto is very convenient but it should never, ever be used on a web page. In fact, it's such an important rule that I will repeat it below:

Never put an email address on a publicly accessible web page

Don't put the email address in hyperlinks - This means don't use the mailto and an email address.

Don't use those special email encoding JavaScript's These convert an email address into Unicode. It becomes unreadable to human beings, but it's pretty simple to find and convert these. if the spammers haven't figured it out yet then it's just a matter of time.

Don't use graphicsSome webmasters have decided it's safe to put their email address in a graphic image. Yes, it's safe but it also pretty much guarantees that no one will ever respond.

The problem with mailto

Not defined by HTML 4.0 specification - The HTML 4.0 specification supports URL types such as http. Mailto is not included, which means that how it is interpreted and handled is up to browser designers and vendors.

Mailto is different from browser to browser - Since mailto is not well defined in HTML specifications, the way it works is not the same in all browsers. Internet explorer may do something different than Netscape, Opera or other browsers.

Mailto is handled differently by different email clients - The email client (if there is even one installed) can be vastly different from user to user. Not everyone has Outlook or Outlook Express installed, and the webmaster who depends upon people just using those clients is in for trouble. 

Many people use other email clients Each of these email clients might handle the mailto differently (or may not handle it at all). For example, for those people who use America Online or Hotmail, the mailto won't work.

As part of the mailto you can include a subject (and some other bits of information) by including "?subject=". For example, you could write "joe@anydomain.com?subject=this_is_the_subject" and, in Outlook Express, the subject of the email would automatically be filled in. However, other email clients will not perform this action, and may actually fail with errors.

An email client popping up startles people - I know that I get very annoyed when I click on a link and something unexpected happens. I don't like it when my email clients starts up without my permission or request, and many other users feel the same. Typically a user will immediately close the email message.

Users are afraid of giving you their email address Sending a message from an email client gives the recipient the return address (the user's email address). Many people will simply close the client instead of sending the message for this reason.

Spam harvesters can pick out your email addresses The number one way that spammers get email addresses is to pick them off of web pages. Thus, if you include a mailto link on your page, you are giving your email address to anyone that wants it.

You have no control over the format of the message If you just use a mailto then a message window is displayed. You are more or less depending upon the user to enter the correct data. There is no validation and no way to get this information in a standard way.

The proper way to get information from visitors

Use a form Write, purchase or borrow a script in whatever language you want which handles forms. Create the form to get the input from your visitors. The form can email you the results or add them directly to a database. Just make sure the script DOES NOT get passed the email address in a hidden field. The email address should be either coded in the script itself or in a parameter file of some kind.


Unless otherwise noted, all photos and text is Copyright © Richard G Lowe, Jr.