Cloaked links: shown to Google, not to you

Why the site owner doesn’t see it

Injected code often checks who is asking for the page. If the request looks like a search-engine crawler, or arrives from a Google search result, the page includes extra links. If the owner opens the page directly, those links are missing, so the site looks clean while search engines read spam.

The three views Link Signals compares

The comparison costs two extra page requests, so it runs on the homepage and roughly 10% of other pages, chosen the same way every time. In monitoring, each check also re-reads a different slice of pages whose sitemap date has not changed, with the comparison included, so pages outside the sample are covered over time.

How it appears in a report

A cloaked link is marked Needs review at the least, even when the destination looks harmless, because the way it is served is the signal. If the destination is also on a blocklist, it is Not safe. Sites also vary content for ordinary reasons, such as rotating ad or related-post links, so a cloaked flag is a reason to look, not a verdict.

What to do when you find one

1. See what Google seesIn Google Search Console, use URL Inspection and View crawled page for the page in Found on, and look for the anchor text shown in the finding.
2. Compare with your own viewOpen the same page directly and view its source. If the link is in Google’s copy but not yours, the page is being served differently to crawlers.
3. Find where it comes fromCheck theme files, plugins, .htaccess and the database options table. Code that tests the visitor’s user agent or referrer is the giveaway.
4. Remove it and scan againRemove the code, change the passwords that could have let it in, update plugins and themes, clear caches, and run a new scan.

Why cloaking matters

Cloaking is the hardest form of link injection to notice, because the people best placed to spot it are the ones it is built to avoid. Google’s spam policies treat showing search engines different content from visitors as cloaking, and a site that does so, knowingly or not, risks losing visibility. Meanwhile the owner sees a clean page and has no reason to suspect anything.

Legitimate reasons a page differs

• Rotating ads, related-post lists and “recently viewed” widgets that change on each request.
• Personalisation or geographic variation.
• A cache that serves an older copy to some requests.

These can produce a link that appears in one view and not another. The flag is a reason to look at the link and its destination.

Reading the finding

The finding’s reason says which view carried the link: “only shown to search engines” or “only shown to people arriving from a search”. A cloaked link is reported under Out of context in the action plan, as it is treated as concealed, and the Cloaked badge shows in the findings table.

Common mistakes

• Checking only the page you can see. Always compare with what Google reports for the same address.
• Cleaning the page output but not the code that decides who sees what, so the links return.
• Stopping after one clean scan. Pages outside the sample are not compared, so a hack can sit on pages that were not examined.
• Blocking the Link Signals crawler to stop the flags. See block the Link Signals crawler for what that does and does not change.

How to confirm it is fixed

Run a re-check from the report’s Overview tab after the fix. It reads only the pages your flagged links are on, so it takes a minute or two. Marking a finding as reviewed does not close it: the next scan reads the page again and calls the finding resolved only when the link is gone or no longer flagged. On a monitored site, later checks keep watching for it to come back.

In your report

Cloaked links are counted on the Out of context links card on the Overview tab, in the red Shown only to search engines number, under the card’s Priority 3 chip (the default). In the Findings tab, Review these links opens the Out of context tab, where a cloaked link has a red Cloaked chip.

• The detail panel says which view carried the link: “appears when the page is requested as a search-engine crawler, but not on a normal visit”, or “appears only for people arriving from a Google search, not for a direct visit”.
• Only the pages that were compared can show this chip. A clean report does not mean that the pages outside the sample were clean.
• The card’s advice for any concealed link is to treat it as a possible hack: find out how it was added, remove it and change your passwords.
• The same link is also counted in the Hidden from visitors number on a category card, such as Pharma or Gambling.

The panel also warns that cloaking can be legitimate dynamic content, so open the page source before deciding. Out of context links explains the rest of the card.

How this counts in your LinkSignal

A cloaked link is counted in the hidden, cloaked and script-injected links row of your site’s external LinkSignal, together with hidden and script-injected links, and only once. See how the score is worked out for the points and the LinkSignal overview for the other rows. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.