Cloaking is the practice of sending different content to different requesters. A cloaked page gives search engines one version and ordinary visitors another. Google’s spam policies treat it as a violation, because the page that is ranked is not the page people get.
Why hacks use it
A hidden link can be found by viewing the page source, and the owner might spot it. Cloaking removes even that chance. A compromised site can check the user agent or the referrer of each request and add spam links only when a search crawler, or a visitor from a search result, asks. You open your own site directly, see nothing odd, and the damage carries on in search results until a warning appears.
| Page requested as | Extra spam link in the page? |
|---|---|
| A direct visit | No |
| A search-engine crawler | Yes |
| A visitor arriving from a Google search | Yes |
How Link Signals checks
Link Signals requests a sample of pages three ways and reports links that appear only in the search views. The homepage is always compared, plus about 10% of the other pages, chosen in a fixed way so the same pages are picked each time. One extra view uses a search crawler’s identity. The other is a browser arriving from a Google search result. A link that shows up only in one of those is marked as shown only to search engines, or only to visitors from search, and is treated as concealed.
In monitoring, the rotating slice of pages re-read on each check also gets the comparison, so a cloaked link can be found even when a page’s date never changes.
Common misunderstandings
- Cloaking is not the same as personalisation. Showing a different language or a cookie notice by location is normal. It is a problem when the aim is to show search engines something else.
- Only about 10% of pages get the comparison. A cloaked link on an unsampled page can be missed.
- A site that recognises real search crawlers by their network address, not just their name, can still tell that a request is not genuine, so this check cannot catch everything.
How the comparison works, and what it cannot catch, is on cloaked links.
Questions
Why can’t I see the link in my browser?
That is the point of cloaking. The link is not served to you. Use the page given in Found on and check the file or plugin that adds it.
What should I do if I find one?
Treat the site as compromised. After a WordPress hack lists what to check and clean.
How this counts in your LinkSignal
Cloaked links are counted in the hidden, cloaked and script-injected links row of your site’s external LinkSignal, with hidden and script-injected links. See how the score is worked out for the points. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.
Run a scan and find where these show up on your own site.
