Instead of including their phone number within the post body, Craigslist users are encouraged to enter their phone number in a separate input field. Then, when the post is displayed, a button appears in the post body:

Screenshot from Craigslist showing "show contact info" button.

When you click on the button, Craigslist makes an XHR request that fetches the entire body of the post, including the phone number, and replaces the existing body with the newly fetched body.

How is this more secure? If I'm writing a scraper, all I have to know is the post ID and the URL format of that XHR request and I can get the phone number. So what makes this more secure?

As a side question, is there a better way to protect user phone numbers? I'm creating a product where user phone numbers will be publicly accessible (as they are on Craigslist) and I want to protect them as much as possible.

  • 3
    Without knowing what Craigslist is doing, it's impossible to say. My first suspicion would be that this particular endpoint is rate limited, and/or requests to it get special examination or treatment.
    – Xander
    Commented Jun 10, 2016 at 17:36
  • 1
    I would encourage you to edit the side question out of this one and ask it as a question on its own (possibly with a reference to this one). It is a more interesting question and deserves to be something more than a sidenote.
    – Anders
    Commented Jun 10, 2016 at 22:58
  • It makes using a general-purpose scraper impossible to gather the phone numbers (a simple Python script with a regex for phone numbers won't work for example) and forces the developers to actually adapt their scraper to the site. Unless they explicitly target the site most won't bother doing that. Commented Jun 13, 2016 at 1:43
  • It might also not be security-related at all, but a simple way to gather statistic on the proportion of person who see the listing and the ones who want to act upon it. Commented Sep 17, 2019 at 14:37

2 Answers 2


This is not necessarily directly a security measure. I don't know why this design was made, but I do see an obvious advantage to hiding sensitive information behind an extra click: a non-malicious scraper — such as a search engine — won't include it. So when the listing is gone, so is the private information. If the information was easy to scrape, it could linger for a long time on Google's cache, or even forever on the Web Archive.

  • I'm marking this as the correct answer because it's something I hadn't considered—I wasn't thinking of non-malicious scraping (e.g. Google). It makes sense that you'd want to keep phone numbers out of long-term caches.
    – David
    Commented Jun 15, 2016 at 0:00

That type of approach does drastically reduce the scraping because it makes it much more complex to do.

Note that there is no ideal way to block it completely since they want the information to be available to the other users. With OCR systems, even placing it as an image is still far from perfect.

  • This is a great point. Although scraping is still possible, it makes it more difficult—"garden fence" security.
    – David
    Commented Jun 14, 2016 at 23:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .