Cloaking
Cloaking is the practice of showing search engines different content or URLs from what human visitors see, in order to manipulate rankings. It is a clear breach of Google’s spam policies and can lead to a page or a whole site being demoted or removed from search results.
How cloaking works
A cloaking site checks who is requesting a page, usually by looking at the user agent or IP address. If it detects a search engine crawler, it serves one version, and real visitors get another. Typical examples include:
- Serving a keyword-rich article to Googlebot but an image-heavy sales page or unrelated site to users.
- Showing text about one topic to crawlers while visitors see gambling, adult or pharmacy content.
- Inserting extra text or links only when the request comes from a search engine.
Cloaking is common on hacked sites, where attackers add spam pages visible only to Google so the owner does not notice. See hacked site recovery.
Why it is against the rules
Google’s spam policies name cloaking as spam because it misleads both the search engine and the user: people click a result expecting one thing and get something else. It also undermines Google’s ability to judge a page fairly, since what it assesses is not what people see.
Google can respond with algorithmic demotion or a manual action for cloaking and sneaky redirects. Serious cases can see a whole site removed from results.
What is not cloaking
Some legitimate practices change content for different visitors without counting as cloaking:
- Personalisation and localisation: showing local prices or language, as long as Googlebot is treated the same as a user from the same location.
- Paywalls: Google supports structured data for paywalled content, which lets you show crawlers the full article while users see a paywall, without it being treated as cloaking.
- Responsive design: layouts that adapt to screen size while keeping the same content.
- Dynamic rendering: serving pre-rendered HTML to bots, as long as the content matches what users get. Google now describes it as a workaround rather than a long-term solution.
How to check for cloaking
- Use the URL Inspection tool in Search Console to view the page as Google sees it, and compare it with the live page in a browser.
- Search site:yourdomain.com and look for pages or titles you do not recognise.
- Check the Security issues and Manual actions reports in Search Console.
- Review server configuration files, such as .htaccess, and plugins for rules that target bot user agents.
- Ask someone outside your network, or on a different device, to load key pages and compare what they see.
Common causes on legitimate sites
Cloaking is not always deliberate. Badly configured A/B testing tools, bot-blocking firewalls or geo-redirects can accidentally show Googlebot a different page. If you run experiments, Google advises against treating Googlebot differently from users.
Further reading: Google’s spam policies for web search.
Key Takeaways
- Cloaking shows search engines different content from what users see.
- It is named as spam in Google’s spam policies.
- Hacked sites often contain cloaked spam that the owner cannot see.
- Personalisation, paywalls and responsive design are not cloaking when done properly.
- Compare the URL Inspection tool’s view with the live page to spot problems.
Related Terms
Want to know where your site stands? Book a free SEO health check, or keep learning in the SEO Encyclopedia.