by
Ralf Weber
4.4 (19 reviews)
CryptX
No more SPAM by spiders scanning your site for email addresses!
CryptX ranks #2,136 among WordPress.org plugins with 10,000+ active installations, is #92 of 3,349 in the Communication category, a 4.4/5 rating from 19 reviews, and was last updated Sep 11, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v4.2.1
Current Version v4.2.1
Updated 4 days ago
Last Update on 11 Sep, 2026
Refreshed 14 hours ago
Last Refreshed on
#92 of 3,349 in Communication
Top 5% by installs
Downloads +567.5% this week
Actively maintained
Rank
#2,136
-1 this week
Active Installs
10K+
-8.3%
KW Avg Position
40.2
—
No change
Downloads
301.5K
+33 today
Support Resolved
100%
—
No change
Rating
88%
Review 4.4 out of 5
4.4
(19 reviews)
Next Milestone 20K
10K+
20K+
715
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 8,927 more installs to reach 20K+
Rank Changes
Current
#2,136
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
4.4
19 reviews
Overall
88%
5
16
(84%)
4
0
(0%)
3
0
(0%)
2
1
(5%)
1
2
(11%)
Support Threads Overview
Resolved
Unresolved
1
Total Threads
1
Resolved
0
Unresolved
100%
Resolution Rate
Security History
Source: WPVulnerability1 known vulnerability on record · 1 in the last 24 months · checked 1 week ago
-
CVE-2025-13739 · Fixed in v4.0.6
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 4.2.1
- Last Updated
- Sep 11, 2026
- Requires WP
- 6.7+
- Tested Up To
- 7.1
- PHP Version
- 8.1 or higher
- Author
- Ralf Weber
Support & Rating
- Rating
- ★ ★ ★ ★ ☆ 4.4
- Reviews
- 19
- Support Threads
- 1
- Resolved
- 100%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,752
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,007
Contact Form 7
10M+ installs
#3
WP Mail SMTP by WPForms - The Most Popular SMTP and Email Log Plugin
4M+ installs
#12
MC4WP: Mailchimp for WordPress
1M+ installs
#34
Hostinger Reach - AI-Powered Email Marketing for WordPress
1M+ installs
#44
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
1M+ installs
#55
Flamingo
800K+ installs
#80
Joinchat - Enhanced "click to chat"
700K+ installs
#88
Click to Chat - HoliThemes
600K+ installs
#92
TL;DR
AI summary of the plugin's readmeCryptX is for WordPress site owners who want to protect published email addresses from spam bots. It automatically detects email addresses in content and encrypts them using methods like JavaScript, Unicode conversion, and image replacement while keeping them functional for visitors.
- Automatic email detection
- JavaScript encryption
- Unicode conversion
- Image replacement
- Widget support
- RSS feed control
- Whitelist support for domains
- Shortcode support
Frequently Asked Questions
Common questions about CryptX
CryptX uses various methods to hide email addresses from spambots while keeping them functional for visitors. Methods include JavaScript encryption, Unicode conversion, and replacing emails with images or custom text.
CryptX is designed to be lightweight and only loads JavaScript when needed. The performance impact is minimal.
Yes. Under Settings / CryptX / Exceptions there is a list of addresses to leave alone. Write "info@example.com" for a single address, or "@example.com" to cover every address at that domain. CryptX leaves those addresses exactly as written -- it does not mask, link or encrypt them -- which is what you want for an address a helpdesk has to read out of the page, or one shown in a code example. There are two limits on purpose. Inside [cryptx]...[/cryptx] -- and inside the "Protected email address" block, which is the same instruction in a different shape -- nothing is exempt: it says "protect this one, here", and a setting made months ago on another screen is not an answer to that. Where the shortcode is written somewhere WordPress never expands it, such as a hand-written excerpt, this reaches a little further: an exempt address standing next to it in the same text is protected as well. That is the harmless direction, but worth knowing if you exempted an address precisely so a machine could read it. And in comments only a whole address counts, never the domain form -- otherwise exempting your own domain would hand out every address at that domain a visitor happened to leave in a comment. One more thing worth knowing about comments: WordPress itself turns a bare address into a link before CryptX ever sees it, so an exempt address stays readable there but does become a link. That distinction rests on which filter the text arrives through, and only comments can be told apart with certainty. Forum and front-end submission plugins -- bbPress and BuddyPress among them -- send what a visitor wrote through the same filter as your own posts, so the domain form does apply there. If your site takes text from visitors that way, exempt the individual addresses rather than a whole domain. Two neighbouring settings answer different questions. The list of endings ("jpeg,jpg,png,gif") is what keeps file names such as logo@2x.png from being mistaken for an address in the first place. The list of post IDs switches CryptX off for a whole post or page.
An address such as "post@münchen.de" is not protected -- CryptX looks for addresses using the ASCII form, so it does not recognise one with an accented or non-Latin domain in the first place. Write the domain in its punycode form ("post@xn--mnchen-3ya.de") and everything works as usual. The editor block says so where you type it; elsewhere the address is simply left as it was.
Yes, including network activation. Every site keeps its own settings and its own encryption secret, so nothing one site publishes can be read with another site's key. Sites created later are set up the same way as those that existed at activation time, and uninstalling removes the plugin's data from every site in the network. The settings live per site, because that is where the addresses and the design live. A site administrator configures their own site as usual. Since 4.2.0 a network administrator can set the defaults a newly created site starts with, under Network Admin / Settings / CryptX -- a starting point, not an instruction: sites that already exist are never changed by it, and a site administrator can change theirs at any time. Two settings are missing from that screen on purpose. The list of excluded post IDs and the uploaded image both refer to things that exist on one site only: post 17 on one site has nothing to do with post 17 on another, and copying that list would exclude the wrong posts -- which is precisely what left addresses unprotected on some networks before 4.1.1.
Yes, with WP-CLI. wp cryptx settings lists every setting with its current value; wp cryptx settings <name> reads one and wp cryptx settings <name> <value> writes it, through the same validation the settings screen uses. wp cryptx scan is the one worth knowing about. It runs every published post through the filters that render it and reports the ones that still carry a readable address -- the question you actually have after changing a setting, and the one the settings screen cannot answer, because it only ever renders a single sample. An "encoded" verdict means the address is in the page as HTML entities: invisible to a naive scanner, plain to anything that decodes them. It reads the body and the title of each post, and a "where" column says which of the two. Titles matter here because CryptX cannot protect them: a title goes into the document head through WordPress itself, along a path no plugin filter touches. An address in a post title is readable, and the only fix is to take it out of the title.
On a network both take --url, so wp site list --field=url | xargs -I{} wp cryptx scan --url={} covers the whole network.
CryptX primarily works with email addresses displayed in content. It doesn't interfere with contact forms or other form functionality.
Yes, you can enable the meta box feature to control encryption on individual posts and pages. For more information, visit the Plugin Homepage
