Cloaking is a black-hat SEO technique that serves different content or URLs to search engines than to human visitors in order to manipulate rankings. Google's Spam Policies explicitly forbid it. A site caught cloaking receives a manual action, ranking suppression, or full removal from the Google index. Most modern cases are unintentional — hacked sites, buggy user-agent detection, or aggressive personalization.
In 2026, intentional cloaking is rare. The larger problem is accidental cloaking — a compromised WordPress plugin, a rendering bug, or an over-eager geo-redirect that serves Googlebot something no user would ever see. The penalty is identical either way.
What is cloaking?
Cloaking is the practice of deliberately serving different HTML, text, or entire pages to search-engine crawlers than to human visitors from the same URL. The intent is to game ranking signals — the crawler sees keyword-optimised content, the user sees something else entirely.
Google's Spam Policies define cloaking as any of:
- Serving a page of HTML text to search engines while showing a page of images or Flash to users
- Inserting text or keywords that appear only when the user agent is a crawler
- Redirecting real users to a different URL than the one crawlers see
- Injecting content into the DOM only when a search-engine IP is detected
Google's Spam Policies explicitly list cloaking as a violation. Detection is automatic (crawlers cross-check user-agent responses) and the resulting manual action is visible in Search Console under Security & Manual Actions. Sites can lose 90-100% of organic traffic overnight.
Why cloaking matters
- It is the fastest way to lose an entire domain. Manual actions for cloaking are among the harshest — full deindexing is common.
- It can happen unintentionally. Hacked plugins, geolocation redirects, and paywall implementations can trigger it without the site owner knowing.
- Recovery is slow. Even after a reconsideration request is approved, ranking recovery takes months.
- It undermines E-E-A-T. Sites that cloak lose trust signals across the entire domain, not just the offending pages.
- Modern search engines all detect it. Google, Bing, and third-party AI search engines all use user-agent parity checks.
How cloaking is implemented (and detected)
Historically cloaking used server-side branching on the incoming User-Agent or IP address:
$ua = $_SERVER['HTTP_USER_AGENT'];
if (strpos($ua, 'Googlebot') !== false) {
// Serve keyword-stuffed page to crawler
include('seo-version.html');
} else {
// Serve real page to humans
include('human-version.html');
}
Google catches this in three ways:
- Fetch-as-user comparison. Google renders the page with a Chrome user-agent from a residential IP, then compares to the Googlebot version.
- Spam-report intake. Competitors report suspected cloaking through Google Search Console.
- Machine-learning classifiers. Trained on years of known cloaked pages, flags divergent user-agent responses at scale.
Types of cloaking
| Type | How it works | Google's stance |
|---|---|---|
| User-agent cloaking | Serves different HTML based on User-Agent header | Spam policy violation |
| IP cloaking | Serves different content based on visitor IP range | Spam policy violation |
| JavaScript cloaking | Shows one version pre-JS render, another after | Spam policy violation |
| HTTP referer cloaking | Content changes based on the referring URL | Spam policy violation |
| Dynamic serving | Different HTML per device with matching intent | Allowed with correct Vary header |
| Personalization | Content varies by logged-in state or location | Allowed if crawlers see the default |
Real cloaking examples
1. Affiliate spam site
An affiliate site serves Googlebot a long-form informational article about "best insurance for freelancers", but real users get redirected via JavaScript to a thin lander with a single affiliate link. Detected in 2023, deindexed within a week.
2. Hacked WordPress site
A legitimate SaaS blog gets compromised. Attackers inject a plugin that shows Googlebot pharmaceutical spam and shows humans the original content. Owner sees rankings collapse and finds the "Cloaking and/or sneaky redirects" manual action in Search Console. Cleanup, plugin audit, and reconsideration take six weeks.
3. Geographic paywall implementation
A publisher blocks EU visitors due to GDPR but forgets to add the same block to Googlebot IPs. Google indexes the full article; EU users see a "Not available in your region" message. Google's guideline requires the crawler and users see the same content — this is technical cloaking, even unintentionally.
Cloaking vs dynamic serving vs personalization
The distinction hinges on intent and parity. Different content is fine when the purpose is device optimisation or user experience. It is not fine when the purpose is to deceive.
Allowed (not cloaking)
- Serving mobile HTML to mobile devices, desktop HTML to desktop (dynamic serving)
- Showing a login page to authenticated users, marketing content to visitors
- Geo-localised prices or store pickup options with matching product information
- Ad-supported vs ad-free versions where the substantive content matches
- Language variants selected by
Accept-Languagewith hreflang
Cloaking (violation)
- Serving keyword-stuffed text to Googlebot only
- Hiding text from users using CSS but exposing it to crawlers
- Redirecting real users to a different URL after render
- Injecting spam content only when the user-agent matches Googlebot
- Showing crawlers a fake product page and humans a lead form
6 practices to avoid accidental cloaking
- Serve the same content to all user agents. Do not branch server-side on User-Agent unless doing legitimate dynamic serving with proper
Vary: User-Agent. - Verify with URL Inspection. Use Google Search Console's URL Inspection tool to see exactly what Googlebot sees. Compare against what a logged-out incognito browser sees.
- Audit third-party plugins quarterly. WordPress ecommerce and SEO plugins are the most common vector for compromised cloaking.
- Monitor manual actions. Search Console notifies you the day a manual action lands. Alert the whole team so nothing lingers.
- Rendering parity for JavaScript sites. If SSR/CSR versions diverge in content, Google can flag it. Keep hydration deterministic.
- Geo-redirects should apply to Googlebot too, or not at all. Blocking users while letting the crawler index the full article is a common accidental cloak.
A site rewrites its home page in a way that shows crawlers a lot more text than it shows mobile users, thinking it will rank better. Google's mobile-first crawler now reads the mobile version primarily — so the "SEO version" is not even seen for ranking. All risk, no reward.
Common cloaking mistakes to avoid
- Hidden text with CSS
display:none. Hidden keyword text that only crawlers parse counts as cloaking. - Fetching different data by user-agent for the same URL. If Googlebot sees a completely different data payload, this is cloaking.
- Doorway pages with a redirect. A page that ranks for a keyword and then redirects the user to an unrelated product is a form of cloaking.
- Ignoring a manual action. Delaying reconsideration costs weeks of traffic and compounds trust loss.
- Assuming AJAX-loaded content is invisible to Google. Googlebot renders JavaScript. Content injected client-side is still indexed and can still trigger cloaking flags if it does not match.
Frequently asked questions
Cloaking is not illegal in most jurisdictions, but it violates Google's Spam Policies and Bing Webmaster Guidelines. Sites caught cloaking receive manual actions, ranking suppression, or full removal from the index.
Google compares the content returned to Googlebot against what a human browser sees using different user agents and IP ranges. It also uses fetch-as-Google, spam-report reviews, and machine-learning classifiers trained on known cloaked pages.
Confirmed cloaking triggers a manual action visible in Google Search Console. Consequences range from ranking suppression to full removal from search results. Recovery requires removing the cloaked content and submitting a reconsideration request.
No. Dynamic serving delivers different HTML to different devices (mobile vs desktop) from the same URL and is explicitly allowed by Google if the content intent matches. Cloaking is intentionally different content by user agent to deceive.
No. Personalization by logged-in state, location, or preferences is allowed provided Googlebot sees the same default content a first-time visitor would see.
Related glossary terms
How theStacc helps
theStacc's technical audit performs user-agent parity checks on every important URL, cross-references Googlebot rendering against human rendering, and flags any content divergence. If a manual action has already landed, we scope the cleanup and draft the reconsideration request. Delivered in 24 hours.