Privacy Masking
Privacy masking automatically detects and partially obscures email addresses and phone numbers in filtered content. It is independent of the blocked keyword list — it runs on any content type that is enabled in Filter Scope, regardless of what keywords you have set.
Both options are in the Privacy Masking section on the General Settings tab. Both default to on at installation.
Mask Email Addresses
Section titled “Mask Email Addresses”Option key: wbbprof_settings[mask_emails]
When enabled, the plugin finds email addresses in content text and masks the username and domain name parts. The top-level domain (TLD) is kept visible.
Masking pattern:
- Username: first and last characters are kept; middle characters are replaced with the Filter Character
- Domain name: first character is kept; remaining characters are replaced
Example with the * character:
user@example.com → u***r@e******.comhi@test.org → h*@t***.orgUsernames two characters or shorter are fully replaced.
The masking also strips mailto: anchor tags from content — the text of the link is preserved but the href is removed.
Only plain text nodes are processed. Email addresses inside HTML tag attributes (such as data-email or inside URLs) are not touched.
Mask Phone Numbers
Section titled “Mask Phone Numbers”Option key: wbbprof_settings[mask_phones]
When enabled, the plugin detects phone numbers and replaces the middle digits with the Filter Character. The first digit and last two digits are kept visible. Formatting characters (spaces, hyphens, parentheses) in the original number are preserved.
Detected formats:
| Format | Example | Masked result (using *) |
|---|---|---|
International with + |
+1-123-456-7890 |
+1-1**-***-**90 |
| US with parentheses | (123) 456-7890 |
(1**) ***-**90 |
| 10-digit plain | 123-456-7890 |
1**-***-**90 |
| 11-digit starting with 1 | 1-123-456-7890 |
1-1**-***-**90 |
International with 00 |
0012345678 |
001*******78 |
As with email masking, only plain text nodes are processed. Numbers inside HTML attributes are not masked.
When masking runs
Section titled “When masking runs”Privacy masking runs after keyword replacement. So if a content item contains both a blocked keyword and an email address, the keyword is replaced first, then the email masking pass runs on the result.
Masking only runs on content types that are enabled in Filter Scope. If “Messages” is disabled, email and phone masking do not run on private message content either.
Effect on stored data
Section titled “Effect on stored data”Masking is applied at display time only. The original email addresses and phone numbers remain unchanged in the database.