I work on OnePassApps, and this is our own site, so I measured it myself: plain HTTPS, signed out, no browser and no JavaScript, on 10 November 2026. I read the sitemap once and then fetched each of its 56 URLs once.

One hidden address, 74 anchors, two shapes

Across those 56 documents there are 74 anchors pointing at Cloudflare's email-protection rewrite, /cdn-cgi/l/email-protection. They are not all built the same way. 51 of the 74 carry a hex fragment in the href, and on those the __cf_email__ class and the data-cfemail attribute sit on a span inside the anchor. 23 of the 74 carry no fragment at all, and on those the same two things sit on the anchor element itself.

The 23 are exactly the guide fleet

The 23 anchors with no fragment live on 23 pages, and those 23 pages are exactly the guide fleet: the guides index and the 22 guide pages. The other 33 pages - the home page, /voting, /plans, /terms, the seven studios and the 22 app pages - hold the anchors that do carry a fragment.…