What Is Cloaking?

Cloaking means showing search engines different content from what the visitor sees, with the intent to manipulate rankings in the SERP and mislead whoever arrives. That last part is not decoration: it is in the definition Google publishes, and it separates a forbidden practice from a legitimate difference.

The examples Google cites are unambiguous: showing the search engine a page about travel destinations while the user sees one about discount drugs, or inserting text and keywords only when the requester is a crawler.

It is classed among spam practices, that is, in the territory of black hat SEO, and it can cost rankings or presence in the results entirely.

The scope deserves settling first, because the term is misused in two directions. It is not cloaking that a page changes over time, nor that two people in different countries see different things. What defines the practice is the pair: search engine on one side, user on the other, and a difference put there on purpose.

Nor is it an old technique that has disappeared. It keeps turning up, especially on sites compromised by third parties: whoever arrives via a link sees advertising for something else while the crawler keeps receiving the legitimate page — and the owner does not notice for weeks, because in their own browser everything looks normal.

Here sits the confusion that causes the most groundless fear. Many sites deliver different things depending who asks, and almost none of those differences is cloaking.

About dynamic rendering Google is unambiguous: it does not consider it cloaking, as long as it produces similar content. And it adds the converse just as clearly: using it to serve completely different content is cloaking.

The same holds for everyday cases: an error page, a version adapted for another country declared with hreflang, content behind a registration. None of them exists to deceive, and so none falls under the definition — even though in all three the server delivers something different.

A third case deserves naming because it looks very similar and is not: personalisation. A site that remembers your past purchases and puts different products on the homepage shows every visitor something different — and something different from what the search engine gets, arriving with no history. None of that exists to deceive.

The practical rule that follows applies to every case: ask whether what the search engine sees is a reasonable version of what a person will see. If a visitor could end up seeing that same thing, there is no cloaking; if it is a page no human will ever receive, there is. The index ends up holding whatever was served, which is why the question matters.

Technically cloaking is built two ways: by looking at the user agent requesting the page, or at the IP address the request comes from. In both cases the server decides what to deliver before delivering anything.

Spotting it from outside is simple and needs no expensive tools: request the same URL twice, once identifying as a browser and once as a crawler, and compare. If the two responses do not resemble each other, you have the question that needs answering.

For what Google actually sees, URL inspection in Search Console shows the rendered HTML from its side, and log file analysis shows what was served to it and when. Between those two sources little room for doubt remains.

A precision about checking by user agent: declaring yourself a crawler is not quite enough, because some configurations also look at the IP address. A request from an office in Spain claiming to be Googlebot is not the same as one arriving from Google's ranges, and there are setups that distinguish exactly that.

So cross-checking two of your own sources beats any isolated test: the server log says what was actually served to each request, and a technical SEO review comparing those lines with URL inspection closes the circle. What is useless is trusting what you see in your own browser.

The first and most frequent is paid content. Showing the search engine the full article and the reader an extract sounds like cloaking and is not, when declared with the markup provided for it; what is not allowed is doing it silently.

The second is regional adaptation. Serving prices in another currency or a different language by country, the norm in international SEO, is normal — as long as it is signalled with the means intended for it and the search engine is not given a version no user ever sees.

And the third arises by accident: an old configuration that, instead of a 301 redirect, keeps returning the previous page to certain user agents after a migration. Nobody did it intending to deceive, and from outside the effect is indistinguishable — better to look yourself before somebody else does.

A fourth edge case arises from good intentions: A/B tests. Splitting visitors between two versions is normal and not cloaking — as long as the split does not depend on whether a search engine is asking, and the variants are versions of the same thing. Always sending the crawler to the same variant is likewise fine; sending it to a page no participant receives is not.

And one more, increasingly common: bot protection. A shield, often the CDN's own, that presents a challenge to anything it does not recognise can end up serving the crawler a verification page instead of the content. There is no intent to deceive, and the effect is that the index fills with pages nobody wrote; you spot it by which response code Google received, not by what appears on screen.

The first is indiscriminate fear: believing that any difference between what a crawler receives and what a user sees is cloaking. It is not, and that belief leads people to give up perfectly valid white hat SEO techniques such as prerendering.

The second is the opposite: thinking it is enough not to have bad intentions. Intent is in the definition, but nobody can read it from outside; if the content served on either side does not resemble the other, the effect is the same however innocent the reason.

And the third is no longer checking. One change in the server configuration is enough for it to appear without anyone deciding — and a penalty for something nobody did on purpose costs exactly as much as a deserved one.

A fourth mistake is treating it as something only other people do. Today's most frequent cases are not deliberate manoeuvres but leftovers: a server rule that survived a migration, a cache layer keying on user agent rather than on the GET parameter, a security module deciding on its own. None of them announces itself.

And the last: not recording the differences that are legitimate. If your site serves something different for a good reason — paywall, country version, bot protection — it belongs written down somewhere in your own team. When somebody looks at those lines in two years, the difference between a documented decision and an unexplained anomaly decides how much time gets lost, just as with any inherited robots.txt rule.