Google and cloaking

Of all the things a page can do to earn a ranking it does not deserve, cloaking is the one search engines describe in the plainest language. It is not a grey area of optimisation. Google lists it among its spam policies, and the definition it uses is the one that matters in practice: presenting different content to search engines than to users, with the purpose of manipulating rankings and deceiving the person who clicks.

Two things in that definition are worth pulling apart, because most arguments about cloaking are really arguments about one of them.

Difference is not the offence

Serving different content is ordinary. A site may answer in a different language, show local prices, run an experiment, or hide part of an article behind a subscription. Google's own guidance accepts all of that, and treats geographic and device-based differences as normal behaviour rather than deception.

What turns a difference into cloaking is the second half: that the search engine is shown something specifically to win a ranking the visitor's version would not win. The test is not "does this page vary" but "was the crawler handed a different page in order to earn the click".

This is also why the accidental cases are usually resolved rather than punished. A page assembled by JavaScript that the crawler cannot run, or resources blocked in robots.txt so that the crawler sees a skeleton, produces a genuine difference with no intent behind it. It is a technical fault, it is worth fixing, and it is not what the policy is aimed at.

What happens to a site that is caught

Two different mechanisms, often confused.

The first is algorithmic: the page or the site loses the ranking it was holding, quietly and with no notification. Nothing is announced, and the operator learns about it from the traffic.

The second is a manual action. A human reviewer at Google examines the site, records a violation, and the site owner sees it in Search Console with a description and a way to request a review after fixing it. Manual actions are the visible, documented path — and the reason a site owner who has never heard of cloaking may suddenly be reading about it.

There is a third outcome that is not strictly a ranking penalty and frightens people the most: the interstitial warning. When Google's Safe Browsing systems decide that a site deceives visitors, the search result is replaced by a red screen warning against visiting. This is aimed at deceptive behaviour broadly, not cloaking specifically, but a cloaked page that sends search visitors somewhere they did not ask to go is an excellent way to earn it.

How the difference is noticed

Google is in a stronger position than anyone else, because it is the only party that can request a page as the real crawler, from its own addresses, and it does so continuously. It can compare what it was served on one visit with what it was served on the next, what the rendered page contains against what the raw response contained, and what visitors do after they arrive.

That last signal is the one operators tend to underestimate. A result that people click and immediately abandon is a result that failed to answer the query, whatever the crawler was shown.

For everybody outside Google the position is weaker, and worth stating honestly: the crawler's own addresses cannot be borrowed. What can be done is to request the page in the ways that expose most conditional serving — announcing the crawler's name, arriving from a search result, and asking from inside Google's own network — and compare the answers. That is what a cloaking check does, and the guide to viewing a page as Googlebot sets out what each method proves and where it stops.

If your own site is accused

The common causes are dull and fixable, and worth ruling out before assuming an attack: resources blocked in robots.txt so the crawler renders a broken page; a country redirect that catches the crawler because it crawls from one country; an aggressive bot-protection rule that serves a challenge page to anything that does not look like a browser; a plugin serving a cached version to crawlers that has drifted from the live one.

There is also the case that is genuinely not your fault. Pages injected into a hacked site are frequently cloaked by design — they show the crawler a casino or pharmacy page and the site's owner nothing at all, precisely so that the owner does not notice. If a site suddenly ranks for subjects it has nothing to do with, this is the first thing to check, and the check has to be made as the crawler, not as yourself.

If it is someone else's page, ranking on your name

Then the policy is not your remedy. Google's spam policies are enforced at Google's discretion and on Google's schedule, and a report does not create an obligation to act or a duty to tell you what happened.

What works is the ordinary route — a notice to the host or the platform, about the content itself — with one addition: the reviewer will open the link, and will be shown the harmless version. A notice that does not anticipate that is closed as mistaken. A notice that records both versions, with the times they were captured, is about a page the reviewer can still see the evidence of, whatever the address shows them today.