What Is Cloaking in SEO?
Updated 26 September 2026
Jump to section
Cloaking is showing search engines one version of a page and human visitors another, on purpose, to win a ranking the real page would not earn. Google names it a spam violation. A cloaked page might feed Googlebot a clean article about travel while sending users to something unrelated, or insert keywords only when a crawler asks for the page. Google's rule is simple: cloaked sites can rank lower or vanish from results.
What counts as cloaking?
Cloaking is deception by audience. Google's spam policies define it as "presenting different content to users and search engines with the intent to manipulate search rankings and mislead users". The page was last updated in August 2026.
Two of Google's own examples make the shape clear:
- Showing a page about travel destinations to search engines while showing a page about discount drugs to users.
- Inserting text or keywords into a page only when the visitor requesting it is a search engine, not a human.
The common thread is intent. The site detects who is asking, usually by reading the user-agent or IP address. It then serves the crawler a page built to rank and the person a page built to convert, scam, or redirect.
How is cloaking different from personalization?
The difference is intent and equivalence, not whether two visitors ever see different pixels.
Serving a Kuala Lumpur shopper prices in ringgit is not cloaking. Showing Googlebot a stuffed article while real shoppers get a discount-drug page is.
The honest test: would Googlebot see the same thing an equivalent human in that context sees? If yes, you are personalizing. If you single out the crawler for special treatment, you are cloaking.
| Technique | Cloaking? | Why |
|---|---|---|
| Geolocation (ringgit prices to Malaysian visitors) | No | Googlebot crawling from that region sees the same page; no deception |
| A/B testing two real layouts | No | Both variants are genuine and temporary; the crawler is treated like a user |
| Responsive design for mobile and desktop | No | Same content, adapted to screen size, served to everyone |
| Feeding Googlebot text while users get a redirect | Yes | Content differs by user-agent, built to manipulate the ranking |
Telling crawlers which pages they may access through robots.txt is also not cloaking. That is honest access control, applied the same to every visitor of that type.
What are sneaky redirects?
Sneaky redirects are cloaking's close cousin, sending a visitor to a different URL than the one they asked for. Google defines the abuse as redirecting "maliciously in order to either show users and search engines different content or show users unexpected content."
The mobile trap is the version Malaysian owners meet most. Google's own example is "showing desktop users a normal page while redirecting mobile users to a completely different spam domain."
In our experience, the first cloaking a Malaysian SME runs into is on a hacked site, not a chosen tactic.
A neglected WordPress install gets injected with hostile code. It keeps the page clean for the owner and Googlebot, then bounces phone visitors from a Google result to an affiliate or scam page. The owner has no idea until traffic or rankings fall.
Why is cloaking a losing bet in 2026?
Cloaking loses because it is built to be caught, and being caught is expensive. Google renders pages the way a browser does, and cloaking is a named violation that human review can catch. Cloaking and sneaky redirects sit on the list of issues that draw a manual action, reviewed by a person, which can remove a site from results.
The mechanism is worth understanding. A ranking earned by a page users never see is a ranking with no foundation. The moment Google serves that result and a real person lands on the hidden page, the mismatch is the evidence.
There is a second referee now. When an answer engine follows a citation and finds a page that does not match what it indexed, the domain quietly loses trust in the citable pool. Deception does not survive contact with either judge, which is the whole case for white hat work.
Frequently asked questions
Is showing different content to mobile and desktop users cloaking?
No. Responsive design serves the same content adapted to screen size, and Google expects it. Cloaking is about deceiving the search engine, not about layout. The line is crossed only when you detect a crawler and feed it a different page than a real visitor on that device would get. A phone user and Googlebot-smartphone should see the same thing.
Is geolocation or currency switching cloaking?
No, when it is honest. Showing ringgit prices to a Malaysian visitor and dollars to a US visitor is normal localization. Googlebot crawling from a region sees what a user in that region sees. It becomes cloaking only if you single out the crawler for content built purely to rank. The test is whether the crawler is treated like any other visitor from that place.
Can my site be cloaking without me knowing?
Yes, and it is common. Hacked sites are frequently injected with cloaking code that hides spam from the owner and Googlebot while redirecting search visitors elsewhere. You would not see it in your own browser. Check with the URL Inspection tool in Search Console, which shows the page exactly as Googlebot fetched it, and watch for a manual action notice.
Is dynamic rendering for JavaScript cloaking?
No. Serving a pre-rendered HTML version to crawlers that struggle with JavaScript is a technical workaround, not deception, as long as the content matches what users get. The intent is to help the crawler read the same page, not to feed it something different. Modern Google renders JavaScript well, so most sites no longer need this at all.
How do I recover if my site was caught cloaking?
Remove the cloaking code first, which on a hacked site means finding and cleaning the injection, then closing the hole that let it in. Confirm Googlebot and users now see the same page. If a manual action was issued, fix every affected page and file a reconsideration request in Search Console. The review takes days to weeks and expects the deception fully gone.
Show everyone the same page
Storming Solutions runs SEO, AEO, and GEO for Malaysian businesses from Kuala Lumpur, and we build sites that show Google exactly what they show customers. Our stance: if a tactic depends on the crawler and the reader seeing different things, it is a liability wearing a strategy's clothes.
Suspect your site is redirecting search visitors somewhere you never intended, or worried a hack left cloaked pages behind? Ask us for a check, or see how we scope clean, durable SEO, AEO, and GEO that never gambles your domain in Malaysian search.