I am working on a searchable online directory. People will use it to find other members, service providers, and the like. It's critical that the results include contact data. However, my clients are very concerned about data harvesting/poaching by marketers, competitors, spammers, and others.
We have toyed with the following ideas to prevent someone from grabbing a lot of contact data at once:
- Do not present contact information in a results list; users must drill in for details.
- Limit the # of searches per minute/hour/day; block offending IP addresses for a period of time.
- Limit the # of results the user can bring back at one time. (We believe it is more likely that users would try a new search vs. scrolling many pages, anyway).
- Encrypt customer IDs in the URL so scripts cannot be executed that test IDs/load their details.
- Render contact information with spaces so it can be visually understood but if copied, requires some manual cleanup. (I don't like this idea, esp. for accessibility).
- Provide a "contact" action that leverages a member's email address without displaying it outright.
We will probably try a few of these but I would love to know if there is a best practice for this sort of security.