# What is cloaking in SEO? Why hacked sites show Google a different page

> Cloaking in SEO means showing search engines different content from what people see. Google treats it as spam, and hacked sites use it to hide injected links from their owners. Here is how it works and how to see what Googlebot sees.

Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/what-is-cloaking-in-seo

Cloaking in SEO is showing search engines different content or URLs from what people see, so that a page ranks for something its visitors never get. Google's spam policies define it as a violation and give examples such as serving a page about travel to search engines and a page about discount drugs to users. Today most cloaking is not done by site owners at all: it is how hacked sites hide injected spam, so the owner sees a clean page while Google indexes pharma links. This guide explains how cloaking works, what is and is not cloaking, and how to see exactly what Googlebot sees. It belongs to the [hacked website guide](https://getreport.app/guides/is-my-website-hacked), which covers the whole recovery.

## Quick answer

- **Cloaking = different content for search engines and people**, chosen by who is asking. Google's spam policies forbid it and can demote or remove the pages.
- **The server decides by** the user agent ("Googlebot"), the IP address (Google's crawler ranges), the referrer (arriving from google.com) or a cookie (logged in, visited before).
- **Not cloaking:** a mobile layout, a translated page for a country, a paywall marked up as Google describes, or an A/B test that treats Googlebot like any visitor.
- **On a hacked site** cloaking hides spam links, generated pages and redirects from the owner. Google's spam policies note that hackers often use it for exactly that reason.
- **See what Googlebot sees** with URL Inspection in Search Console, a `curl` request with Googlebot's user agent, or the [hacked site checker](https://getreport.app/tools/hacked-site-checker).

## What is cloaking?

Google's spam policies describe cloaking as presenting different content to users and search engines with the intent to manipulate rankings and mislead users. Their examples are the classic ones: a page about travel destinations for search engines and discount drugs for people, and text or keywords inserted only when the requester is a search engine.

The idea is old. In the early days of search, sites served keyword-stuffed pages to crawlers and designed pages to people. Search engines responded by fetching pages the way people do and comparing the results, and deliberate cloaking by legitimate businesses became rare, because the penalty outweighs the gain.

What did not go away is cloaking by attackers. Google's policy page says it directly: when a site is hacked, it is not uncommon for the hacker to use cloaking so that the owner has a harder time noticing. For the attacker, cloaking is what keeps a hack alive for months.

## How cloaking works

Every request tells the server something about who is asking. Cloaking code reads it and chooses which version to send.

| Signal | What the code checks | Who it fools | Who still sees it |
| --- | --- | --- | --- |
| User agent | The `User-Agent` header contains "Googlebot", "bingbot" and so on | The owner, any normal visitor | Anyone who fakes a Googlebot user agent |
| IP address | The request comes from Google's published crawler ranges, or reverse DNS ends in `googlebot.com` | Everyone outside Google, including tools that fake the user agent | Only Google's own fetch, such as URL Inspection |
| Referrer | The `Referer` header is google.com, bing.com or yahoo.com | The owner, who types the address or uses a bookmark | Visitors who click a search result |
| Cookie or login | A WordPress login cookie, or a cookie set on the first visit | Logged-in owners and returning visitors | New, logged-out visitors |
| Device | A mobile user agent | Owners checking on a desktop | Phone users |
| JavaScript | A script that rewrites the page after load, only for some visitors | Tools that read the raw HTML | Browsers and Google's renderer |

Hacked sites often combine several. A typical injection serves spam links only when the user agent says Googlebot **and** redirects visitors only when they arrive from a Google result **and** skips anyone with a WordPress login cookie. The owner, logged in and using a bookmark, fails all three tests and never sees a thing.

Here is what the simplest server-side version looks like, injected at the top of a theme's `functions.php` or a fake plugin:

```php
// Injected: spam only for search engine crawlers
if ( preg_match( '/googlebot|bingbot|yandex/i', $_SERVER['HTTP_USER_AGENT'] ?? '' ) ) {
    echo file_get_contents( 'https://spam-domain.example/links.txt' );
}
```

Real injections are usually obfuscated with `base64_decode`, `gzinflate` or string tricks so that a search for "googlebot" in your files does not find them. [Pharma and casino spam injections](https://getreport.app/guides/pharma-and-casino-spam-injections-how-they-hide) shows the common shapes and where they hide.

## What is not cloaking

Serving different pages to different visitors is normal. It becomes cloaking when search engines get something that people do not, or the other way round, with the aim of ranking for it.

- **Responsive design and dynamic serving.** Sending a lighter layout to phones is fine when the content is the same and the server sends `Vary: User-Agent`.
- **Language and country versions.** Showing a Croatian page to visitors in Croatia is fine; use hreflang, and do not force-redirect Googlebot, which mostly crawls from the US.
- **Paywalls and metered content.** Google supports paywalled content when you mark it up with the paywalled-content structured data it documents, so Googlebot can see the full text while visitors see a paywall.
- **A/B tests.** Google's guidance says tests are fine when Googlebot is treated like any visitor: do not single it out, use `rel="canonical"` on variant URLs and 302 redirects for tests, and end the test when it is done.
- **Bot protection.** Blocking or challenging bad bots is fine as long as verified search engine crawlers get the same page as people.

The test is simple: would a person who clicked the search result see what Google indexed? If yes, it is not cloaking.

## Why cloaking hurts a site

Google treats cloaking as spam whoever does it. Deliberate cloaking can lead to a manual action, which Search Console lists under Security & Manual Actions → Manual actions as "Cloaking and/or sneaky redirects", and to pages dropping out of the results.

Cloaking caused by a hack usually shows up as a security issue instead: Search Console's Security issues report lists hacked content with sample URLs, and results can carry the label "This site may be hacked". [What the "This site may be hacked" label means and how to remove it](https://getreport.app/guides/this-site-may-be-hacked) covers that label step by step. Either way, rankings fall, and the spam keeps borrowing your domain's reputation until it is removed.

The damage extends to people, too. Referrer cloaking sends visitors from Google to scams, adult sites or fake downloads, and they blame your brand, not the attacker. [Hacked website redirects](https://getreport.app/guides/hacked-website-redirects) covers that variant.

## How to check what Googlebot sees

### URL Inspection in Search Console

This is the only method that catches every kind of cloaking, including the IP-based kind, because the request really comes from Google.

1. Open Search Console for the site and paste the URL into the inspection bar at the top.
2. Click **Test live URL**, then **View tested page** → **HTML**. That is the page as Googlebot fetched it just now.
3. Search the HTML (Ctrl+F) for words and domains that do not belong: `viagra`, `casino`, `loan`, `.ru`, or any link you did not add.
4. Back on the inspection result, **View crawled page** shows the copy Google has indexed, which may be older.

It only works for sites you have verified, one URL at a time.

### A fetch with Googlebot's user agent

For any site, compare a normal fetch with one that claims to be Googlebot:

```bash
curl -s -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" https://example.com/ -o visitor.html
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://example.com/ -o googlebot.html
diff <(grep -o 'href="[^"]*"' visitor.html | sort -u) <(grep -o 'href="[^"]*"' googlebot.html | sort -u)
```

Links that appear only in `googlebot.html` are the finding. This catches user-agent cloaking, not IP-based cloaking.

### The hacked site checker

> **Free tool:** [View a page as Googlebot: hacked site checker](https://getreport.app/tools/hacked-site-checker): View your page as Googlebot and as a visitor from Google, side by side, to find cloaking, pharma and casino spam links and hidden redirects. Free, no sign-up.

The checker fetches the page three times: as a normal visitor, with Googlebot's user agent, and as a browser arriving from `https://www.google.com/`. It compares the visible words, links and inline scripts of the three copies. When at least 30% of the Googlebot or Google-visitor copy is missing from the visitor copy and at least 20 words are new, the cloaking finding fires, with the words and links as evidence.

> **Check: Visitors and Googlebot see the same page text.** The page was fetched as a normal visitor, as Googlebot and as a visitor arriving from Google. The bot or Google-referrer copies contain text that visitors never see. That is the pattern of a hacked site that hides spam from its owner, and Google treats cloaking as a violation. Some sites vary content by user agent on purpose; check the evidence.
>
> 1. Open the page as Googlebot (Search Console URL Inspection → View crawled page, or curl with a Googlebot user agent) and compare it with a normal visit.
> 2. If the extra content is not yours: change every password, update WordPress, themes and plugins, scan the file system for modified core files and unknown PHP files (wp-content/uploads, mu-plugins), restore from a clean backup if in doubt, then request a review in Search Console under Security Issues.

> **Check: No spam links and no links served only to bots.** Links with pharma, gambling, loan or replica vocabulary, or links that only Googlebot and Google visitors receive, are the fingerprint of an injection: someone is using your domain's reputation to rank their pages. Google demotes sites that carry them.
>
> 1. Search the database and theme files for the linked domains (wp_posts, wp_options, header.php, footer.php, functions.php) and remove the injection; look for an unknown plugin or a modified core file that re-adds it.
> 2. Update everything, rotate passwords and keys, then request a review in Search Console.

> **Check: No redirect that fires only for Googlebot or Google visitors.** The page sends visitors who come from Google, or Googlebot itself, to another site, while direct visitors see the normal page. Owners rarely notice because they never arrive from Google. Search results show the spam target and the site loses its rankings.
>
> 1. Look for the redirect in .htaccess or the nginx config, in wp-config.php and index.php, in theme header and footer files, in the database (wp_options siteurl/home and injected scripts in posts), and in inline scripts that read document.referrer.
> 2. Remove it, update and clean the site, rotate passwords, and request a review in Search Console.

> **Check: No hidden outbound links.** Links inside containers with display:none, visibility:hidden, zero font size or an off-screen position are invisible to visitors but counted by search engines. Legitimate pages rarely need them; injections use them constantly.
>
> 1. Find the hidden container in the page source (search for the linked domain) and remove it. If it comes from a plugin or theme, that is the compromised or spammy component.
> 2. If the links are yours and intentional (a collapsed menu, a screen-reader-only list), keep them; the finding is a warning, not a penalty.

The result says "differences found", never "hacked", because some sites vary content on purpose. It does not run JavaScript, and it fetches from getReport's servers, so cloaking keyed to Google's real IP addresses does not show. When the checker is clean but Google shows spam, trust Google and use URL Inspection on the exact URLs it lists.

## What to do if you find cloaking

**If you did it on purpose,** or a plugin or agency did it for you, remove it: serve Googlebot the same page as people. If Search Console shows a manual action, fix every page it lists and request reconsideration in the Manual actions report, explaining what you changed.

**If you did not,** the site is hacked. Removing the visible spam is not enough, because the code that decides who gets it, and usually a backdoor, is still there. Follow the order in [the hacked website guide](https://getreport.app/guides/is-my-website-hacked): save the evidence, update, find and remove the injection and the backdoor, reinstall code from clean sources, change every password, then request a review. On WordPress, [recovering a hacked WordPress site](https://getreport.app/guides/recovering-a-hacked-wordpress-site-step-by-step) has the command-line walkthrough.

Search your files for the tell-tale checks, bearing in mind that obfuscated code will not match plain text:

```bash
grep -rlE "HTTP_USER_AGENT|HTTP_REFERER" --include=*.php wp-content/ | xargs grep -lE "googlebot|google\.|bing" 2>/dev/null
grep -rn -iE "googlebot|HTTP_REFERER" .htaccess
```

Legitimate plugins read the user agent too, so review each hit rather than deleting on sight.

## Common mistakes

- **Checking only while logged in.** Many injections skip logged-in users. Use a private window, or better, the tools above.
- **Trusting a fake-Googlebot fetch alone.** IP-based cloaking gives it the clean page. Confirm with URL Inspection.
- **Blocking Googlebot to "hide" a problem.** Search engines then cannot see your fixes, and the pages drop out anyway.
- **Treating geo-redirects as harmless.** Forcing every US visitor, including Googlebot, to an English page can hide your other versions from Google. Offer a choice instead and use hreflang.

## Questions people ask

### Is cloaking illegal?

No, cloaking is not illegal in itself; it breaks search engines' rules, not the law. Google's spam policies forbid it and can demote or remove pages that use it. It becomes a legal matter when it is part of something else, such as a phishing or scam redirect on a hacked site, or deceptive advertising that shows reviewers different content from customers.

### What is the difference between cloaking and a sneaky redirect?

Cloaking serves different content at the same URL depending on who asks. A sneaky redirect sends people somewhere other than what search engines were shown, for example only visitors arriving from Google or only mobile users. Google groups them in one manual action, "Cloaking and/or sneaky redirects", and hacked sites often use both at once.

### Can Google detect cloaking?

Yes, in most cases. Google fetches pages from its own addresses with and without its crawler's user agent, renders them, and compares what it sees with what users get, and it receives spam reports. Clever cloaking can survive for a while, but a hacked site that shows spam to Googlebot is exactly what Google's hacked-content detection looks for, which is why the "This site may be hacked" label appears.

### Is showing a different page to mobile users cloaking?

No, as long as the content is equivalent. Responsive design and dynamic serving for mobile are normal; send `Vary: User-Agent` if the HTML differs by device, and keep the same main content, structured data and links on both versions. It becomes a sneaky redirect when phone users are sent to unrelated pages, which is a common pattern of hacked sites.

### Why does URL Inspection show links I cannot see on my page?

Because the page is serving Googlebot something it does not serve you, which is cloaking. URL Inspection fetches from Google's own addresses, so it also receives spam that checks for Google's IP ranges. If those links are not yours, the site is hacked: find the code that chooses who gets the spam, remove it with any backdoor, reinstall code from clean sources, then request a review.