Glossary
Cloaking
Cloaking is serving different content to search engine crawlers than to human visitors for the same URL.
Updated 2 Sept 2026
In detail
Cloaking is a spam technique in Google's terms, and a concealment technique when used by an attacker on a compromised site. The URL returns one response to Googlebot — usually keyword-rich spam — and another to a browser, which may be the site's genuine page or a redirect to an affiliate destination. Google treats cloaking as a policy violation regardless of who placed the content, so an owner who does not know their site is cloaking still absorbs the consequences.
Why it matters
Cloaking is the reason compromised sites are discovered late. Owners check their own pages, see nothing wrong, and dismiss Search Console warnings as false positives while the indexed spam keeps growing. It also makes remediation harder to verify: a page that looks clean in a browser can still be dirty when fetched as a crawler.
Examples
- A page that returns pharmacy keywords to a Googlebot user agent and the real product page to Chrome.
- An injection that redirects only visitors whose referrer is google.com, leaving direct visits untouched.
- Spam rendered only on the first request from a given IP address, so a second manual check appears clean.