What Is Cloaking in SEO?

Cloaking is showing search engines different content than you show users, with the intent to manipulate rankings and mislead visitors. Google names it in its spam policies and treats it as a serious violation — penalties range from a ranking demotion to complete removal from search results. Intent is part of the definition, which is why several things that look like cloaking aren't.

Google's definition, and why the wording matters

The spam policies put it this way: cloaking is presenting different content to users and search engines with the intent to manipulate search rankings and mislead users. Two examples are given — serving a page about travel destinations to search engines while serving discount drugs to users, and inserting text or keywords into a page only when the requester's user agent is a search engine.

That final clause is the whole policy in miniature. The offence isn't variation. The web serves different bytes to different visitors constantly — by language, device, login state, region. The offence is variation designed so that the crawler forms a false impression of the page.

How cloaking is actually implemented

Three mechanisms cover nearly everything you'll encounter:

User-agent detection. The server reads the User-Agent header, sees Googlebot, and returns a keyword-rich version. This is the crudest form and the easiest to catch, because Google crawls from user agents that don't announce themselves.

IP-based delivery. The server checks the requesting IP against known search-engine ranges. Harder to detect from the outside, since a browser test from your desk gets the user version, and historically the tactic of choice for the more organised end of spam.

Script-level swapping. The page ships one DOM to a crawler and rewrites it after load for real visitors, or hides the keyword payload behind CSS the crawler doesn't apply. Google renders JavaScript, so this fails more often than its practitioners expect.

Related but distinct is the sneaky redirect — same page for the crawler, instant bounce elsewhere for the human. Google files it alongside cloaking in Search Console's manual actions, and the intent test is identical.

What is not cloaking

This is where most of the anxiety lives, and most of it is misplaced.

Personalisation and geolocation. Showing prices in local currency, or a different homepage to a logged-in customer, is normal. Google's crawlers largely see the logged-out, US-default view, and that's fine as long as it's the same view any equivalent visitor gets.

A/B tests. Running two variants is standard practice. Keep tests time-boxed, use a rel="canonical" pointing at the original, and use temporary (302) rather than permanent redirects for split tests. A test that runs indefinitely with the crawler pinned to one variant starts to look like the thing it isn't.

Paywalled content. This one has an explicit carve-out. Google's documentation on paywalled content says the structured data markup for it "helps Google differentiate paywalled content from the practice of cloaking, which violates spam policies." Mark the gated section with the appropriate CSS selector and isAccessibleForFree, and serving the full text to Googlebot while gating it for readers is sanctioned. Skip the markup and you're relying on Google to guess. The link-side consequences are covered in do links behind a login or paywall count.

Consent and cookie banners. An interstitial everyone sees, crawler included, is not cloaking. A banner that blocks humans while the crawler sails through to the content is closer to the line.

Dynamic rendering. Serving pre-rendered HTML to bots was a Google-suggested workaround for JavaScript-heavy sites. Google has since deprecated the recommendation, calling it a workaround rather than a long-term solution, and now points sites at server-side rendering or hydration. It was never classified as cloaking when the content matched — but "when the content matched" was always the load-bearing condition.

The pattern across all five: serve the crawler the same substance a comparable human gets. Format can differ. Substance can't.

The case most people miss: you may be cloaking already

Here's the practical reason this topic matters to sites that have never considered spam tactics. A large share of the cloaking Google encounters isn't chosen by the site owner — it's injected by an attacker.

The pattern is consistent. A vulnerable CMS or plugin gets compromised. The attacker installs code that checks the user agent or referrer and serves pharmaceutical, gambling or counterfeit-goods spam only to search engines, or only to visitors arriving from a Google result. Load the site in your browser and everything is perfectly normal. Meanwhile your domain is indexed for hundreds of pages you've never seen.

The tells:

Search Console shows indexed URLs you don't recognise, often in a directory you never created
Impressions appear for queries wildly outside your topic
A site:yourdomain.com search returns titles in another language or another industry
Traffic drops with a security notice in Search Console

If you find this, treat it as a security incident before an SEO one. Clean the compromise, rotate credentials, patch what let them in, then request a review. A site cleaned superficially gets reinfected within days, and the second manual action is harder to clear. How to recover from a Google penalty covers the reconsideration process.

How to check your own site in five minutes

URL Inspection, live test. In Search Console, inspect a URL, run the live test, and open the crawled HTML. Compare it to your browser's view source. Differences in substance — not whitespace or build hashes — are the signal.
Fetch as Googlebot from the command line. curl -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://yoursite.com/page and diff it against a normal curl. This catches naive user-agent cloaking instantly.
Check the rendered version, not just the source. Script-injected swaps only appear after execution, so use the rendered HTML in the live test rather than the raw response.
Search your own domain. A site: query surfaces indexed pages you didn't publish faster than any crawl of your own sitemap will.
Look at your incoming links too. Compromised sites often acquire an odd link profile alongside the injected pages — how to audit your backlink profile is the companion check.

What it costs

Cloaking is one of the violations Google is least forgiving about, because unlike thin content it can't happen by accident on a healthy site — someone had to write branching logic. Manual actions for cloaking and/or sneaky redirects commonly land site-wide rather than on individual URLs, and deindexing is on the table rather than mere demotion.

There is also no upside worth the exposure. Any ranking cloaking buys is for content the visitor doesn't get, so the traffic converts at roughly nothing while you carry the full risk. Sites reach for it when they can't rank honestly, and the honest fix is the boring one: a page that deserves the query, and enough authority pointing at it to compete. Backlinkster covers the authority half — one-for-one in-content link swaps with real sites in your niche, each verified live by code, free for five a month with plans from $19.

Frequently asked questions

What is cloaking in SEO? Cloaking is serving different content to search engines than to users, intending to manipulate rankings and mislead visitors. It's a named violation in Google's spam policies and can result in lower rankings or removal from search results entirely.

Is cloaking always against Google's guidelines? Cloaking as Google defines it is always a violation, because the intent to mislead is built into the definition. Serving different content for legitimate reasons — personalisation, localisation, properly marked-up paywalls — isn't cloaking.

Is showing different content by country cloaking? No. Serving localised content by region or language is normal, provided crawlers get the same treatment an equivalent visitor from that region would. Problems begin when the crawler is singled out for special content.

Are paywalls cloaking? Not when implemented with Google's paywalled-content structured data. Google states that markup exists specifically to distinguish paywalled content from cloaking. Without it, you're depending on Google inferring your intent.

Can my site be cloaking without me knowing? Yes, and it's a common scenario. Hacked sites frequently serve spam only to search engines or only to search referrals, so the site looks fine in your browser while unfamiliar pages accumulate in the index.

How do I test whether a page is cloaked? Run Search Console's live URL inspection and compare the crawled HTML with what your browser renders, then repeat the request with a Googlebot user agent via curl. Substantive differences between the two are what you're looking for.

The bottom line

Cloaking is the rare SEO violation with a clean definition: if the crawler is being shown something specifically because it's a crawler, and a human would come away with a different understanding of the page, that's cloaking. Everything else — localisation, testing, paywalls, personalisation — passes as long as the substance the crawler sees is the substance a comparable visitor gets. The most useful thing most site owners can do with this topic isn't to avoid the tactic they were never going to use. It's to run the five-minute check and confirm nobody else is doing it on their domain.