What is cloaking in SEO? Why hacked sites show Google a different page

Cloaking in SEO is showing search engines different content or URLs from what people see, so that a page ranks for something its visitors never get. Google's spam policies define it as a violation and give examples such as serving a page about travel to search engines and a page about discount drugs to users. Today most cloaking is not done by site owners at all: it is how hacked sites hide injected spam, so the owner sees a clean page while Google indexes pharma links. This guide explains how cloaking works, what is and is not cloaking, and how to see exactly what Googlebot sees. It belongs to the hacked website guide, which covers the whole recovery.

Quick answer

• Cloaking = different content for search engines and people, chosen by who is asking. Google's spam policies forbid it and can demote or remove the pages.
• The server decides by the user agent ("Googlebot"), the IP address (Google's crawler ranges), the referrer (arriving from google.com) or a cookie (logged in, visited before).
• Not cloaking: a mobile layout, a translated page for a country, a paywall marked up as Google describes, or an A/B test that treats Googlebot like any visitor.
• On a hacked site cloaking hides spam links, generated pages and redirects from the owner. Google's spam policies note that hackers often use it for exactly that reason.
• See what Googlebot sees with URL Inspection in Search Console, a curl request with Googlebot's user agent, or the hacked site checker.

What is cloaking?

Google's spam policies describe cloaking as presenting different content to users and search engines with the intent to manipulate rankings and mislead users. Their examples are the classic ones: a page about travel destinations for search engines and discount drugs for people, and text or keywords inserted only when the requester is a search engine.

The idea is old. In the early days of search, sites served keyword-stuffed pages to crawlers and designed pages to people. Search engines responded by fetching pages the way people do and comparing the results, and deliberate cloaking by legitimate businesses became rare, because the penalty outweighs the gain.

What did not go away is cloaking by attackers. Google's policy page says it directly: when a site is hacked, it is not uncommon for the hacker to use cloaking so that the owner has a harder time noticing. For the attacker, cloaking is what keeps a hack alive for months.

How cloaking works

Every request tells the server something about who is asking. Cloaking code reads it and chooses which version to send.

Hacked sites often combine several. A typical injection serves spam links only when the user agent says Googlebot and redirects visitors only when they arrive from a Google result and skips anyone with a WordPress login cookie. The owner, logged in and using a bookmark, fails all three tests and never sees a thing.

Here is what the simplest server-side version looks like, injected at the top of a theme's functions.php or a fake plugin:

// Injected: spam only for search engine crawlers
if ( preg_match( '/googlebot|bingbot|yandex/i', $_SERVER['HTTP_USER_AGENT'] ?? '' ) ) {
    echo file_get_contents( 'https://spam-domain.example/links.txt' );
}

Real injections are usually obfuscated with base64_decode, gzinflate or string tricks so that a search for "googlebot" in your files does not find them. Pharma and casino spam injections shows the common shapes and where they hide.

What is not cloaking

Serving different pages to different visitors is normal. It becomes cloaking when search engines get something that people do not, or the other way round, with the aim of ranking for it.

• Responsive design and dynamic serving. Sending a lighter layout to phones is fine when the content is the same and the server sends Vary: User-Agent.
• Language and country versions. Showing a Croatian page to visitors in Croatia is fine; use hreflang, and do not force-redirect Googlebot, which mostly crawls from the US.
• Paywalls and metered content. Google supports paywalled content when you mark it up with the paywalled-content structured data it documents, so Googlebot can see the full text while visitors see a paywall.
• A/B tests. Google's guidance says tests are fine when Googlebot is treated like any visitor: do not single it out, use rel="canonical" on variant URLs and 302 redirects for tests, and end the test when it is done.
• Bot protection. Blocking or challenging bad bots is fine as long as verified search engine crawlers get the same page as people.

The test is simple: would a person who clicked the search result see what Google indexed? If yes, it is not cloaking.

Why cloaking hurts a site

Google treats cloaking as spam whoever does it. Deliberate cloaking can lead to a manual action, which Search Console lists under Security & Manual Actions → Manual actions as "Cloaking and/or sneaky redirects", and to pages dropping out of the results.

Cloaking caused by a hack usually shows up as a security issue instead: Search Console's Security issues report lists hacked content with sample URLs, and results can carry the label "This site may be hacked". What the "This site may be hacked" label means and how to remove it covers that label step by step. Either way, rankings fall, and the spam keeps borrowing your domain's reputation until it is removed.

The damage extends to people, too. Referrer cloaking sends visitors from Google to scams, adult sites or fake downloads, and they blame your brand, not the attacker. Hacked website redirects covers that variant.

How to check what Googlebot sees

URL Inspection in Search Console

This is the only method that catches every kind of cloaking, including the IP-based kind, because the request really comes from Google.

1. Open Search Console for the site and paste the URL into the inspection bar at the top.
2. Click Test live URL, then View tested page → HTML. That is the page as Googlebot fetched it just now.
3. Search the HTML (Ctrl+F) for words and domains that do not belong: viagra, casino, loan, .ru, or any link you did not add.
4. Back on the inspection result, View crawled page shows the copy Google has indexed, which may be older.

It only works for sites you have verified, one URL at a time.

A fetch with Googlebot's user agent

For any site, compare a normal fetch with one that claims to be Googlebot:

curl -s -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" https://example.com/ -o visitor.html
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://example.com/ -o googlebot.html
diff <(grep -o 'href="[^"]*"' visitor.html | sort -u) <(grep -o 'href="[^"]*"' googlebot.html | sort -u)

Links that appear only in googlebot.html are the finding. This catches user-agent cloaking, not IP-based cloaking.

The hacked site checker

The checker fetches the page three times: as a normal visitor, with Googlebot's user agent, and as a browser arriving from https://www.google.com/. It compares the visible words, links and inline scripts of the three copies. When at least 30% of the Googlebot or Google-visitor copy is missing from the visitor copy and at least 20 words are new, the cloaking finding fires, with the words and links as evidence.

The result says "differences found", never "hacked", because some sites vary content on purpose. It does not run JavaScript, and it fetches from getReport's servers, so cloaking keyed to Google's real IP addresses does not show. When the checker is clean but Google shows spam, trust Google and use URL Inspection on the exact URLs it lists.

What to do if you find cloaking

If you did it on purpose, or a plugin or agency did it for you, remove it: serve Googlebot the same page as people. If Search Console shows a manual action, fix every page it lists and request reconsideration in the Manual actions report, explaining what you changed.

If you did not, the site is hacked. Removing the visible spam is not enough, because the code that decides who gets it, and usually a backdoor, is still there. Follow the order in the hacked website guide: save the evidence, update, find and remove the injection and the backdoor, reinstall code from clean sources, change every password, then request a review. On WordPress, recovering a hacked WordPress site has the command-line walkthrough.

Search your files for the tell-tale checks, bearing in mind that obfuscated code will not match plain text:

grep -rlE "HTTP_USER_AGENT|HTTP_REFERER" --include=*.php wp-content/ | xargs grep -lE "googlebot|google\.|bing" 2>/dev/null
grep -rn -iE "googlebot|HTTP_REFERER" .htaccess

Legitimate plugins read the user agent too, so review each hit rather than deleting on sight.

Common mistakes

• Checking only while logged in. Many injections skip logged-in users. Use a private window, or better, the tools above.
• Trusting a fake-Googlebot fetch alone. IP-based cloaking gives it the clean page. Confirm with URL Inspection.
• Blocking Googlebot to "hide" a problem. Search engines then cannot see your fixes, and the pages drop out anyway.
• Treating geo-redirects as harmless. Forcing every US visitor, including Googlebot, to an English page can hide your other versions from Google. Offer a choice instead and use hreflang.

Questions people ask

Is cloaking illegal?

No, cloaking is not illegal in itself; it breaks search engines' rules, not the law. Google's spam policies forbid it and can demote or remove pages that use it. It becomes a legal matter when it is part of something else, such as a phishing or scam redirect on a hacked site, or deceptive advertising that shows reviewers different content from customers.

What is the difference between cloaking and a sneaky redirect?

Cloaking serves different content at the same URL depending on who asks. A sneaky redirect sends people somewhere other than what search engines were shown, for example only visitors arriving from Google or only mobile users. Google groups them in one manual action, "Cloaking and/or sneaky redirects", and hacked sites often use both at once.

Can Google detect cloaking?

Yes, in most cases. Google fetches pages from its own addresses with and without its crawler's user agent, renders them, and compares what it sees with what users get, and it receives spam reports. Clever cloaking can survive for a while, but a hacked site that shows spam to Googlebot is exactly what Google's hacked-content detection looks for, which is why the "This site may be hacked" label appears.

Is showing a different page to mobile users cloaking?

No, as long as the content is equivalent. Responsive design and dynamic serving for mobile are normal; send Vary: User-Agent if the HTML differs by device, and keep the same main content, structured data and links on both versions. It becomes a sneaky redirect when phone users are sent to unrelated pages, which is a common pattern of hacked sites.

Why does URL Inspection show links I cannot see on my page?

Because the page is serving Googlebot something it does not serve you, which is cloaking. URL Inspection fetches from Google's own addresses, so it also receives spam that checks for Google's IP ranges. If those links are not yours, the site is hacked: find the code that chooses who gets the spam, remove it with any backdoor, reinstall code from clean sources, then request a review.