What is cloaking?
Cloaking is a lie told to a crawler. A server detects that the visitor is a search engine, by its user agent or its IP address, and serves it a version of the page stuffed with keywords, text or links designed to rank, while serving real people something else entirely: a thin sales page, an unrelated offer, a redirect to a different site. The search engine indexes the version it was shown, ranks the page for queries the human version does not satisfy, and sends people to a page that is not what they searched for.
It is one of the oldest tricks in search and one of the clearest violations of search engine guidelines, alongside doorway pages, hidden text and link schemes. Google's spam policies name it explicitly, and detection has been automated for years: crawlers compare what they were served against what a normal browser sees, and a mismatch designed to deceive is treated as spam. The penalty ranges from losing rankings for the affected pages to removal of the whole site from the index.
Why it matters
Why cloaking matters
It matters mostly as something to never do, and as something to recognize when a vendor proposes it under another name. Brands rarely cloak on purpose; they end up doing it when a search contractor promises fast results, when a developer serves "optimized" text to bots as a shortcut, or when a hacked site is quietly serving spam to crawlers while the owner sees a normal homepage. In each case the consequence lands on the brand: lost rankings, a manual action in Google Search Console, and a recovery process that takes months.
The reason the rule exists is the reason it matters. Search works because the page the engine evaluates is the page the person gets. Cloaking breaks that contract, and the engines defend it hard, because their product is trust. A brand that relies on search for discovery has every reason to be on the same side.
In practice
How cloaking works in practice
- 01
Technically, a cloaking setup inspects each request and branches. If the user agent matches a known crawler, or the IP belongs to a search engine's range, the server returns the crawler version; otherwise it returns the human version. Variants include showing crawlers text that is hidden from users with CSS, serving different content based on referrer so that visitors from search see one page and direct visitors another, and redirecting human visitors through JavaScript that the crawler does not execute.
- 02
Detection works by comparing. Search engines crawl from undeclared addresses and with ordinary browser signatures, render pages the way a browser does, and flag pages whose content differs materially between the crawler view and the user view when the difference looks deliberate. Legitimate differences, such as serving a mobile layout to phones, a language based on location, or paywalled content with proper markup, are allowed because they are declared and serve the user. The test is intent: is the search engine being shown what the person will get? When a site has been hacked to cloak, the fix is cleaning the server, patching the vulnerability, and filing a reconsideration request once the pages match again.
Watch out
What people get wrong about cloaking
Confusing it with legitimate personalization. Showing a visitor a page in their language, a mobile layout or content behind a login they have is not cloaking; the content is consistent, and the crawler is told what is happening. The second mistake is thinking it still works. Modern detection is automated and fast, and the sites that cloak successfully are the ones nobody has looked at yet. The third is not checking for it. A brand whose rankings have fallen for no visible reason should fetch its own pages as a crawler would, because a hacked site cloaking spam looks completely normal from the owner's browser.
