01
The address, drawn, not written
It looks the same, but it’s no longer text.
It appears on screen exactly like the text around it, but it’s no longer text: it can’t be selected or read by a machine.
Anti-spam protection · Cittago
Anti-spam protection: spam stopped by design
A filter just moves spam into another folder. We stop it at the source: your address comes out of the website code, and your forms get an invisible guard.
- Since 2011
- Over 56 brands grown
- 5.0 from 21 Google reviews
The website footerProtection on
What a person sees
Form with no checksInvisible check
What a bot reads
<footer><a href="mailto:[email protected]"><svg role="img" aria-label="email">[email protected]</a><!-- nothing to harvest -->Address harvestedNothing to harvest
Before: the address sits in the code as text, and a bot crawling the page copies it in seconds.After: people see and use the address exactly as before, in one click; the bot finds nothing to harvest.
- 3sources of spam shut off
- 1 dayof work on the website
- 7 daysof measuring afterwards
- 0messages from bots on cittago.com since 6 August 2026
Why you get spam
You’re not the target. You’re just easy to read
The programs that harvest addresses aren’t looking for your company. They crawl pages and copy anything that looks like an email address.
An address written once in your footer ends up, within weeks, on lists that get sold for years. That’s why a filter fixes nothing: the message still reaches the server, and getting off those lists is hard.
The second source is the address itself: info@, office@ and contact@ can be guessed from your domain without ever appearing on the site. The third is forms with no checks, a free, direct route into your inbox. We shut off all three, in the way the page is built.
What you get
What actually changes
Three sources of spam shut off, with nothing extra for your customers to do.
02
Turnstile instead of the old CAPTCHA
No traffic lights to click.
Cloudflare Turnstile checks are invisible to visitors, and the decision is made on the server, where a script can’t get round it.
The Cloudflare page03
Invisible traps in forms
A real person never touches them.
Several mechanisms tell a person from a bot by the way the form is filled in. A real visitor never touches them.
04
One public address
Just one, with a name nobody can guess.
Instead of four inboxes nobody clears, one remains, with a name nobody can guess. The old addresses are wound down properly.
05
Email authentication for your domain
So your own emails don’t land in spam.
We also check what your server says about you when you send, so your own emails don’t end up in your customers’ spam folders.
06
No cost to speed
The check only loads at the form.
The check only loads when someone starts on a form. Every other visit downloads not a single extra kilobyte.
Do you also need a website, SEO or email marketing? We are a full team: what we do not do directly, we deliver with trusted partners, to the same standard.
What it is not
What anti-spam protection at Cittago is not
Four things you will not get from us.
A filter on top of your inbox
We work before the filter: the messages stop heading your way.
A CAPTCHA with traffic lights
The check is invisible to visitors.
A rebuilt website
The changes are visible only in the code, not on screen.
A promise without a number
After a week of measuring, you get the number from your own inbox.
How we work
How the clean-up works
Five steps: the first four change the website, the fifth gives you the number.
It all starts with a 30-minute conversation: we look at where your address is exposed, what your forms let through today and how much of your daily inbox could be stopped. Then, five steps.
- 01
The exposure audit
Where your address appears.
In pages, in the code behind them, in PDFs, in email signatures, in your domain’s public records. There are almost always more places than anyone remembers.
- 02
The address leaves the page
People see it as before; bots don’t see it at all.
The address no longer exists as text in anything the browser downloads. People see it exactly as before and use it in one click.
- 03
Forms get a gatekeeper
Turnstile and invisible traps.
Every form that feeds an inbox goes through a Cloudflare Turnstile check, plus a few invisible traps. Visitors fill it in and send it without ticking anything.
- 04
Spam-magnet addresses, retired
info@, office@ and friends are shut down.
One public address remains. Genuine correspondence is moved across; everything else hits an inbox that no longer exists.
- 05
Seven days of measuring
The number from your inbox.
After the work is done we count, day by day, what still gets through and fine-tune the thresholds. The final deliverable is a number from your inbox, not a promise in a proposal.
Boutique studio
What it means to work with a boutique studio
Four things you notice in the day-to-day collaboration.
01
Few clients, time for each
Few clients, so every account gets the time it needs.
We do not take on every project. We work with a small number of clients, so that every account gets the time and attention it needs.
02
The same person, from the first conversation
The strategist from the first conversation is the one who manages your campaigns.
The senior strategist you talk to at the first meeting is the one who manages your campaigns. We do not hand you over to someone else once we start.
03
Involved in your business
We look at the whole path to the sale, not just at the ads.
We are glad about every new customer we bring you. That is why we do not stop at the ads: we also look at the offer, the website and the message, so that the whole path to the sale works.
04
Relationships that last
Some clients have worked with us for over 10 years.
Some clients have worked with us for over 10 years. It is not us saying it: they wrote it themselves, in their Google reviews.
In brief
Updated: October 2026
- We are Cittago, a boutique digital marketing agency from Cluj-Napoca, Romania, dedicated to our clients. Since 2011 we have done ethical, effective marketing, built to grow along with each client's business.
- We stop spam at the source: the address comes out of the website code, forms get invisible Cloudflare Turnstile checks, and easy-to-guess addresses are retired. On cittago.com, bot spam has been at zero since 6 August 2026.
- We work in Romanian, English and Italian, with clients in 6 countries. To date we have grown over 56 brands.
- Today, Cittago's rating on Google is 5.0, from 21 reviews.
- We do not work with contracts that keep clients tied to us. We prefer to earn their trust through results: we start gradually and accelerate together only when there is potential.
Frequently asked questions
Questions about spam protection
Direct answers to what people ask us before the first conversation.
1What does website-level spam protection mean?
Your addresses can no longer be read by machines from the page code, every form checks that a person is filling it in, and generic, easy-to-guess addresses are retired. It isn’t a filter on top of your messages: it’s the way the website is built, so the messages stop heading your way.
2Isn’t a spam filter on the inbox simpler?
A filter deals with the symptom, not the cause. The message still reaches the server, still takes up space and still needs checking now and then in case something genuine landed there, and your address stays on lists that get resold for years. We work before the filter: the address can no longer be harvested, and the forms can no longer be filled in by bots.
3Realistically, how much spam goes away?
On our own website, days that used to bring as many as 20 spam messages now bring zero from bots, since 6 August 2026; what still turns up, rarely, is typed by a human. We don’t promise everyone the same number, because it depends on how long your address has been out there and how many lists it’s on. We promise the source is shut off, and we give you the number measured after the first week.
4Can customers still email me just as easily?
Yes, exactly as before. The address looks on screen just like the text around it, and one click opens their email app with your address filled in. The difference is invisible to a person and total for a bot reading the page.
5Do I need to rebuild my website?
No. The changes are targeted and visible only in the code: how the address is displayed, what the forms check, which inboxes stay open. What your customers see on screen doesn’t change. We work on your existing website, whatever it’s built on.
6How long does it take?
The website work usually takes one working day, and the old addresses are wound down properly, with genuine correspondence moved across. Then come seven days of measuring, when we count what still gets through and fine-tune if needed. You get the final report at the end of that week.
7Can I check how exposed my address is myself?
Yes. There’s a free email exposure checker on cittago.com: give it your website address, and it crawls your pages and shows how many addresses a bot would harvest there. The number appears on screen, and the report with the exact addresses arrives by email. Free, no account needed.
Let's get acquainted
The first meeting is free and lasts 30 minutes: online, by phone or, if you are in Cluj, over a coffee. You tell us about your business, and we tell you honestly how we can help.
Prefer a message? You can reach us on WhatsApp, by email or by phone and we will reply directly.
No preparation and no follow-up pressure. If we are not a good fit, you leave with better questions to ask whoever comes next.