You open your website and everything looks fine. Meanwhile Google is reading a page full of pharmacy, casino or loan spam on the same address. This trick is called cloaking, and it is one of the main reasons hacked sites stay hacked for weeks without the owner noticing.
This guide explains what cloaking is, how attackers use it on hacked websites, how to detect it and how to clean it up. It applies to every platform, including WordPress, Shopify, Joomla, Magento, Wix and custom-built sites.
What is cloaking?
Cloaking means a website shows different content to different visitors at the same web address. The usual split is between search engine crawlers such as Googlebot and real people.
Google's spam policies treat cloaking as a violation. When it is the owner's own choice, it can lead to a manual action and removal from search results. When a hacker installs it without your knowledge, the result is the same for your rankings, but the fault lies in your security.
How hackers use cloaking
An attacker who gets into your site adds a small piece of code that checks who is asking for a page. Then it decides what to show:
- Crawler check. If the visitor is Googlebot or another search crawler, the code serves a page stuffed with spam keywords and links to the attacker's sites. You and your customers never see it.
- Referrer check. If the visitor arrives from a Google search result, the code redirects them to a scam, adult or pharmacy page. If they type your address directly, the site looks normal.
- Logged-in check. If the visitor is logged in as an admin, the code hides everything, so the owner is the last person to see the problem.
- Device or country check. Only mobile visitors or visitors from certain countries get the spam, which makes it even harder to reproduce.
The goal is to use your site's reputation to promote the attacker's pages, or to send your search traffic somewhere else, for as long as possible before you catch on.
Warning signs of cloaking
- Google results for your site show titles and descriptions about topics you never cover.
- People tell you they were sent to another website after clicking your Google result, but you cannot reproduce it.
- Google Search Console shows a security issue or pages you did not create.
- Traffic from search falls while direct traffic stays the same.
- Your page looks clean in a browser but the cached or crawled version in Search Console looks different.
How to check your site for cloaking
1. Inspect the page as Google sees it
In Google Search Console, open URL Inspection, paste a page address and choose Test live URL. Then view the crawled page and its HTML. If it contains text or links that your own browser does not show, the page is being cloaked.
2. Test as a visitor from Google
Search for your brand name on Google, then click your result using a phone on mobile data or a private window that is not logged in to your website. Note where you land. Redirects that happen only from search results confirm a conditional redirect.
3. Compare requests from the command line
If you are comfortable with a terminal, fetch the same page with a normal browser user agent and with a Googlebot one, and compare the size and content of the two responses:
curl -s https://yourdomain.com/ | wc -c
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://yourdomain.com/ | wc -cA large difference in size is a strong hint. Some attackers also check the visitor's IP address, so a clean result does not prove the site is safe.
4. Search your code for the conditions
Look in theme or template files, plugins or extensions, and any file recently modified, for code that reads the visitor's user agent or referrer. Typical clues are the words googlebot, HTTP_USER_AGENT, HTTP_REFERER and google next to a redirect or an include. Be careful: some real caching and analytics tools check these values too, so inspect each match before deleting anything.
5. Use a scanner that tests both views
A scanner can fetch your pages as a normal visitor, as Googlebot and as a visitor from Google, then compare the results for you. UrKavach does this from the outside, on a schedule, and alerts you when a difference appears, so a cloaked page does not stay hidden for weeks.
How to remove cloaking
- Back up the site and database before changing anything.
- Remove the malicious code from files and the database. Replace core software, plugins, extensions and themes with clean copies from official sources.
- Check for backdoors and unknown admin accounts. If a hidden way back in remains, the cloaking returns after you clean it.
- Change all passwords: website admins, hosting, FTP/SFTP and the database. Turn on two-factor login.
- Review server rules such as
.htaccessor your web server's rewrite configuration for redirects you did not add. - Re-test as Googlebot and as a Google visitor to confirm the difference is gone.
- Ask Google to re-crawl. Resubmit your sitemap, and request a review in Search Console if you had a security warning.
How to prevent cloaking attacks
- Update your website software, plugins and themes promptly and remove what you do not use.
- Use strong, unique passwords and two-factor login for everyone with access.
- Limit the number of admin accounts and review them regularly.
- Monitor file changes, new admin users and the content that Google and visitors receive, with alerts to your email or Slack.
Frequently asked questions
Is cloaking always the result of a hack?
No. Some site owners do it on purpose, which Google treats as spam. But on a website you never meant to cloak, it is almost always a sign of a hack.
Why can't I see the spam on my own website?
The code usually targets search crawlers and visitors from search, and often hides itself from logged-in admins. Your own browser is the least likely place to see it.
Can cloaking get my site removed from Google?
It can lead to a security warning, lower rankings or a manual action. After a full clean-up and a successful review, rankings usually recover.
How can I detect cloaking without technical skills?
Use Google Search Console's URL Inspection to see the page as Google does, or run an outside scan that compares what visitors and Googlebot receive.