Data scraping

Public pages and leaky forms can be vacuumed up and reused against you later.

Scraping is automated collection of information from websites, apps, or documents — staff directories, emails, prices, photos, comments, or anything a login or an API leaves too open. Some scraping is ordinary (a search engine indexing a public page). Some of it is fuel for spam, spear phishing, credential stuffing, or a competitor’s file on your customers.

What is going on

If a page is public, a script can usually read it. If a form, a search box, or an API answers too generously, a script can walk through it at a speed no human would. Layered on top of that, leaked or bought databases get mixed with whatever was scraped, so a “public” email can become a very personal message.

You cannot hide a genuinely public site from the internet. You can decide what truly needs to be public, and you can make bulk collection harder.

How it gets used against you

A list of staff names and roles makes a convincing fake “new vendor” or “CEO” email. Personal emails and phone numbers become smishing targets. Repeated login attempts use addresses collected from a site. Customer quotes, pricing, or internal jargon turned public can be replayed in a lure.

Practical limits you can set

Start with what you publish, then with how your site behaves under a flood of requests.

Publish role or department contacts where you can, rather than every personal inbox.
Avoid posting organograms, mobile numbers, and ID-style photos unless you have a real reason.
Rate-limit forms and APIs. Require a proof-of-work or a challenge when traffic looks automated. Watch for sudden, patterned request spikes.
Do not leave directory listings, backup files, or debug pages on a production host.
On social accounts, tighten what is public. Staff can use that same habit on their own profiles.
If you handle other people’s data, collect only what you need, say why, and keep it no longer than you must — that is good practice and, in many places, a legal duty.