What is cloaking, and how to spot it on your site

Cloaking is serving one version of a page to search engines and a different version to people. Google’s spam policies treat it as a violation when it is done to manipulate rankings or mislead users, and sites caught doing it can lose their rankings. Many site owners only discover cloaking after their site was hacked, because the attacker set it up without telling them.

Why hacked sites use cloaking

An attacker who breaks into a site usually wants to borrow its reputation in search. They add spam pages or spam links that are only shown to crawlers like Googlebot, so the owner and regular visitors see nothing unusual. Search results start showing strange titles, often in another language, and people who click them may be redirected to the attacker’s site. Because the owner never sees the spam, this can go on for a long time.

The code usually decides what to show by looking at one or more of:

• The user agent, for example anything containing “Googlebot”.
• The visitor’s IP address, checked against the ranges search engines crawl from.
• The referrer, for example redirecting only visitors who arrive from a Google results page.
• Whether the visitor is on a phone, or whether they have visited before (a cookie).

Differences that are not cloaking

Not every difference is a problem. These are normal as long as search engines and people get substantially the same content:

• Personalisation, like showing a signed-in user’s name.
• Content that changes by country or language, when it does not single out crawlers.
• A/B tests that are temporary and show real variants to crawlers too.
• Paywalled or members-only content marked up the way search engines document for it.
• Rotating content such as the latest articles, prices, or a cookie banner.

How to spot cloaking on your own site

1. Search your domain. Run site:yourdomain.com and read the titles and descriptions. Spam titles, pages you never made, or text in a language you do not publish in are strong signals.
2. Use Google Search Console. URL Inspection shows the HTML and a screenshot of what Googlebot actually fetched. The Security Issues report lists hacked content Google has detected.
3. Click through from search. On a phone, in a private window, search for your site and click the result. Referrer-based redirects often only show up this way.
4. Fetch with a Googlebot user agent. Tools that request your page as Googlebot and as a normal browser, then compare the two, catch user-agent cloaking. They will not catch cloaking that checks Google’s real IP addresses, which is why Search Console’s own view matters.

What Gmork compares

The free hacked check loads your homepage three ways: as a visitor, as Googlebot, and as someone arriving from a Google search. It reports redirects, injected scripts, and spam links in any of those views. For sites added to Gmork, the Google tab compares the status code, final address, title, description, main text, and outside links that Googlebot and a visitor receive, and flags significant differences. Gmork never scrapes Google’s result pages; optional search-result monitoring uses an official search API.

If you find cloaking

Treat it as a hack unless you know exactly why the difference exists. Follow the cleanup steps in How to tell if your website has been hacked, then ask Google to recrawl the affected pages from Search Console. Spam results fade as Google recrawls the clean pages.