Cloaking
Cloaking is serving different content to search engine crawlers than to human visitors for the same URL.
Updated 2 Sept 2026
In more detail
Cloaking is a spam technique in Google's terms, and a concealment technique when used by an attacker on a compromised site. The URL returns one response to Googlebot — usually keyword-rich spam — and another to a browser, which may be the site's genuine page or a redirect to an affiliate destination. Google treats cloaking as a policy violation regardless of who placed the content, so an owner who does not know their site is cloaking still absorbs the consequences.
Why Cloaking matters
Cloaking is the reason compromised sites are discovered late. Owners check their own pages, see nothing wrong, and dismiss Search Console warnings as false positives while the indexed spam keeps growing. It also makes remediation harder to verify: a page that looks clean in a browser can still be dirty when fetched as a crawler.
How it works
The injected code branches on request attributes before rendering: the User-Agent string, a reverse DNS or IP check against known crawler ranges, the Referer header, cookies, or geolocation. Some payloads add a first-visit-only rule so the spam appears once per IP address, which defeats casual re-testing.
Examples
- A page that returns pharmacy keywords to a Googlebot user agent and the real product page to Chrome.
- An injection that redirects only visitors whose referrer is google.com, leaving direct visits untouched.
- Spam rendered only on the first request from a given IP address, so a second manual check appears clean.
How it is detected or measured
Use Search Console's URL Inspection live test to see the crawled HTML, then fetch the same URL with a Googlebot user agent, with a Google referrer, and from a different IP address. Any difference in the main content between those responses is cloaking.
Frequently asked questions
- Is showing different content by country cloaking?
- No. Localisation and personalisation are fine when crawlers are treated the same way as users from the same context. Cloaking is specifically about detecting the crawler and changing the content because of it.
Where this matters
- Cloaking
Cloaking serves different content to search engines than to people. It is the mechanism that keeps most injected spam invisible to site owners.
- How to Detect SEO Spam on Your Website
A repeatable detection routine: search-side checks first, then crawler-view comparison, then file and database review.
Sources
- Cloaking — spam policies — Google Search Central
Definition of cloaking and its treatment as a spam policy violation.
- URL Inspection tool — Google Search Console Help
Live-testing the HTML Google actually receives for a URL.