Is all content variation cloaking?

No. Localisation, personalisation, paywalls and experiments are acceptable when search engines receive substantially the same content as users in the same context. Cloaking specifically means showing crawlers content designed to deceive them.

Can I detect cloaking with a user agent switcher alone?

Sometimes. Implementations that also check IP ranges will keep serving clean content to a spoofed user agent, so combine user agent tests with Search Console's URL inspection to see the crawler's actual view.

SEO Spamadvancedattack technique

Cloaking

Cloaking serves different content to search engines than to people. It is the mechanism that keeps most injected spam invisible to site owners.

Cyber Security Space editorial desk · Published 2 Jul 2026 · Updated 14 Aug 2026 · 2 min read · Reviewed 14 Aug 2026

Short answer

Cloaking is the practice of serving different content to search engines than to human visitors, based on signals such as user agent, IP address, referrer or session cookies. On a compromised site it is the delivery mechanism that lets injected spam rank in search while the owner sees a normal page.

Key takeaways

Cloaking is a delivery technique, not a payload — it hides keyword spam, hidden links and redirects alike.
Testing means diffing responses across at least three request profiles: normal browser, crawler user agent, and search referrer.
Verify crawler identity by reverse DNS; attackers also cloak by IP range, so user agent testing alone can miss it.
Cloaking is an explicit search spam violation regardless of who installed it.

How does cloaking work technically?

The injected code inspects the incoming request and branches. Cheap implementations match the user agent string against a list containing Googlebot and Bingbot. More careful ones check the client IP against published crawler ranges, or verify reverse DNS, and cache the verdict so repeat requests stay consistent. Some add a third branch for visitors arriving from search results, which is where redirects are usually attached.

User-agent cloaking: Branching on the User-Agent header, the easiest form to detect.
IP cloaking: Branching on the client IP address, so a spoofed user agent from an ordinary network still sees clean content.
Referrer cloaking: Branching on the Referer header to target only visitors arriving from search engines.

How do you test a page for cloaking?

STEP 01
Capture a baseline
Fetch the page with a normal desktop browser user agent and store the HTML.
STEP 02
Fetch as a crawler
Repeat with a Googlebot user agent. Any structural difference in body content is a cloaking signal.
STEP 03
Fetch with a search referrer
Repeat with a search engine referrer and no cookies to surface referrer-gated payloads.
STEP 04
Compare against the rendered page
Use Search Console's URL inspection to see what Google actually received, and compare it with your baseline.

Legitimate variation exists — localisation, A/B tests, paywalls and personalisation. Cloaking is about deceiving the crawler, so judge intent and consistency, not the mere presence of a difference.

Why does cloaking make incidents last longer?

Because the owner's own testing returns clean pages, cloaked compromises are usually reported by a third party: a customer, a search warning, or a partner. That delay gives the attacker time to index thousands of pages and establish persistence, which is why cloaked spam takes longer to clear from search than the technical cleanup itself takes.

Frequently asked questions

Is all content variation cloaking?: No. Localisation, personalisation, paywalls and experiments are acceptable when search engines receive substantially the same content as users in the same context. Cloaking specifically means showing crawlers content designed to deceive them.
Can I detect cloaking with a user agent switcher alone?: Sometimes. Implementations that also check IP ranges will keep serving clean content to a spoofed user agent, so combine user agent tests with Search Console's URL inspection to see the crawler's actual view.

Sources

Cloaking — Google Search CentralSupports: Policy definition of cloaking.
Verifying Googlebot — Google Search CentralSupports: Reverse DNS verification of crawler identity.