Cloaking

What cloaking is

Cloaking is showing Googlebot one version of a page and human visitors a different one, on purpose, to manipulate rankings. It is a clear violation of Google's spam policies — not a gray area — and it is one of the fastest ways to earn a manual action that tanks or de-indexes your site.

The stakes are severe. Cloaking isn't a ranking-factor nudge you can risk; get caught and a human reviewer at Google can slap your whole site with a penalty that wipes out organic traffic overnight. This page is here so you can recognize it and stay clear — not a how-to. The most common way sites get burned is accidental cloaking, so knowing what it looks like protects you.

A real example

A travel-deals site wanted to rank for "cheap flights to Tokyo." So it served Googlebot a keyword-rich, text-heavy page full of destination content — and served actual human visitors a stripped-down page that redirected straight to an affiliate booking widget. Google's crawler saw helpful content; users saw an aggressive upsell. Google detected the mismatch, issued a manual action for cloaking, and the site vanished from results. A related trap: a page that quietly detects the Googlebot user-agent and swaps in extra hidden keywords for the crawler only. Same crime — the bot and the human get materially different content by design. That intent to deceive is what separates cloaking from legitimate techniques.

Cloaking vs. legitimate techniques

The dangerous confusion is between cloaking and normal, allowed practices that also vary output. The line is intent and equivalence: are you deceiving the crawler, or serving everyone the same core content in a format that fits them?

How to check your own site for accidental cloaking

1. Use the URL Inspection tool. In Google Search Console, inspect a live URL and view the rendered HTML Google actually receives. Compare it side by side with what you see in a normal browser. They should match in substance.
2. Fetch as Googlebot. Request the page with the Googlebot user-agent (via a fetch tool or curl) and diff it against a normal-browser fetch. Big differences in body content are a red flag.
3. Test from Google's IP range, not just user-agent. Some setups serve different content by IP. Confirm your server doesn't special-case Google's crawler IPs with content a user would never see.
4. Audit any user-agent detection in your code. Search your codebase and CDN rules for logic that branches on "Googlebot" or "bot." Every such branch is a place accidental cloaking can creep in. Confirm each one serves equivalent content.
5. Check redirects and JavaScript swaps. Make sure a page doesn't render one thing for the crawler and then client-side redirect or rewrite the body for humans. That mismatch is cloaking even if it started as a caching or A/B-test bug.

Common mistakes and how to fix them

• Serving cached HTML to bots that's stale or different. A misconfigured cache can hand Googlebot a page users never see. Fix: use the Vary header correctly and verify cached crawler responses match live user responses.
• A/B tests that hide variants from Google. Cloaking the crawler out of your test can look deliberate. Fix: let Googlebot into tests normally and use canonical tags — don't branch on user-agent.
• Aggressive bot detection on your firewall/CDN. Security rules that serve Googlebot a challenge or blank page cause invisible cloaking. Fix: allow verified Googlebot through and confirm it gets the real page.
• Old dynamic-rendering setups drifting out of sync. If the pre-rendered bot version stops matching the user version, you've drifted into cloaking. Fix: keep them equivalent, or move to server-side rendering, which Google now prefers.
• Assuming intent doesn't matter. "I didn't mean to" doesn't undo a mismatch Google's systems flag. Fix: treat any bot-vs-user content difference as a bug to eliminate, not a nuance to defend.

FAQ

Is cloaking ever allowed?

No. Serving the crawler materially different content to manipulate rankings is always a spam-policy violation. Techniques that serve everyone equivalent content in a suitable format — dynamic rendering, locale redirects, light personalization — are not cloaking and are fine.

How is cloaking different from dynamic rendering?

Intent and equivalence. Dynamic rendering gives bots a pre-rendered copy of the same content because they struggle with heavy JavaScript — the substance matches. Cloaking gives bots different content to trick them. Same mechanism, opposite purpose.

What happens if Google catches cloaking?

Typically a manual action for a spam-policy violation, which can suppress or fully de-index the affected pages or the whole site. Recovering means removing the cloaking entirely and filing a reconsideration request — a slow, painful process you want to avoid.

Can I cloak accidentally?

Yes, and it's the most common way legitimate sites get hit. Misconfigured caches, overzealous bot-blocking, drifting pre-render setups, and A/B tests that hide variants from Googlebot can all serve the crawler something users don't get. The checks above exist to catch exactly this.

Does showing a paywall to users but full text to Google count as cloaking?

Only if you do it improperly. Google supports gated content through its flexible-sampling guidance and structured data — done that way it's transparent and allowed. Sneaking full text to the crawler while hiding it from users through deception is cloaking.

Related reading

• Dynamic Rendering
• Black Hat SEO
• Manual Action
• The Vary Header and Caching for SEO