RankpediaA plain-English encyclopedia of search

Website Cloaking

Serves one version of a page to crawlers and a different version to human visitors, typically to manipulate search rankings.

If you think any server-side detection is cloaking, you miss that the content is materially different for users vs bots, and that cloaking is black hat SEO.

Key points

  • Do not confuse cloaking with legitimate device adaptation or personalisation done without deceptive intent.
  • Avoid using IP or user-agent detection to show bots content that human visitors never see.
  • Check Google’s spam policies before implementing any dynamic content serving logic.
  • If your page is indexed for claims not visible to users, you risk a manual action or removal from results.

A keyword-stuffed bot page that users never see

An e‑commerce site selling cheap widgets used user‑agent detection, a cloaking method, to serve Googlebot a page packed with “buy cheap widgets” 50 times. Human visitors saw a normal product page with images and reviews. The site ranked #1 for “cheap widgets” for two weeks, then received a manual action from Google and was removed from search results. The owner had to submit a reconsideration request and remove the cloaking code to regain visibility.

Three ways it goes wrong

  • IP detection Serving different content based on IP address. Googlebot’s IP ranges are known, so this method is easily detected and penalised.
  • User‑agent detection Checking the browser’s user‑agent string to show bots a keyword-rich page while humans see a different layout or text is the most common cloaking technique.
  • Sneaky redirects Using JavaScript or server‑side logic to redirect human visitors to a different URL than the one Googlebot crawls. This is classified as a doorway pages tactic.

Three common confusions

  • Localisation is not cloaking Showing different content based on the user’s country or language is legitimate, provided both versions are visible to the respective audiences and not hidden from crawlers.
  • Any detection is not cloaking Using device detection to serve a mobile‑friendly layout is fine. Cloaking only occurs when the content itself is materially different and intended to deceive search engines.
  • Duplicate content is not cloaking Having the same content at multiple URLs is a duplicate content issue, not cloaking. Cloaking involves showing different content to bots vs users, not identical content at different addresses.

Common questions

How do I check if a website is redirected?

Use a tool like Redirect Checker or view the HTTP headers in your browser’s developer tools to see the full redirect chain.

Is cloaking still used today?

Yes, but it is considered an outdated black‑hat SEO technique. Most references classify it as high‑risk and discouraged.

What is the difference between cloaking and personalisation?

Personalisation shows different content based on user behaviour or preferences, but the content is still available to crawlers. Cloaking hides content from users while showing it to bots.

Sources

  1. Google Search Central Defines cloaking as a violation of Google’s spam policies.
  2. Google Search Central Official guidance on what cloaking is and how to avoid it.
  3. Search Engine Land Industry coverage of cloaking cases and enforcement updates.
↑