Your website might be hacked right now—and you wouldn't even know it.
That's the terrifying reality of SEO cloaking: a technique where attackers make your site show different content to search engine crawlers (like Googlebot) than what regular visitors see.
The result? Google sees spam, pharma ads, or malicious redirects while your users see your normal site. By the time you notice, your search rankings may already be tanking.
In this guide, you'll learn what SEO cloaking is, how attackers use it, and how to detect it before it destroys your SEO.
What Is SEO Cloaking?
SEO cloaking is a technique where a website serves different content based on who's visiting—specifically, showing one version to search engine bots and another to human visitors.
When it comes from legitimate site owners, cloaking is a black hat SEO tactic to manipulate rankings. But more often, it's a sign your site has been compromised.
Here's how it typically works:
- Attacker gains access to your website (via plugin vulnerability, stolen credentials, etc.)
- Malicious code is injected that checks the User-Agent header of incoming requests
- If Googlebot visits, the code serves spam content (pharmaceutical ads, casino links, adult content)
- If a regular user visits, they see your normal website
This is why cloaking is so dangerous: you and your users see nothing wrong, but Google sees a completely different (and malicious) site.
Why Attackers Use Cloaking on Hacked Sites
Cloaking gives attackers the best of both worlds:
1. Exploit Your Domain Authority
Your domain has built up trust and backlinks over time. Attackers hijack this authority to rank their spam content.
2. Avoid Detection
By only showing malicious content to search bots, they evade:
- Your visual checks of the website
- Your users noticing anything wrong
- Basic uptime monitoring tools
3. Maximize Profit Before Discovery
The longer the attack goes undetected, the more traffic (and money) they extract from your site's rankings.
The Real-World Damage of SEO Cloaking
If your site is serving cloaked content, here's what's at stake:
Search Engine Penalties
Google actively detects cloaking. Once flagged, your site may be:
- Removed from search results entirely
- Marked with a "This site may be hacked" warning
- Penalized for months even after cleanup
Destroyed Rankings
Even a brief cloaking incident can tank rankings you spent years building. Recovery takes months.
Damaged Reputation
If users see your site flagged as compromised in search results, trust evaporates instantly.
Revenue Loss
For e-commerce and SaaS businesses, the combination of lost rankings and damaged trust directly hits the bottom line.
How to Detect SEO Cloaking
The challenge with cloaking is that you can't see it during normal website visits. You need to check what search engines see.
Manual Detection Methods
1. Google Search Console
Check the "Security & Manual Actions" section for warnings. Look at the "URL Inspection" tool to see how Google renders your pages.
2. "Fetch as Googlebot" (Search Console)
Use Google's tool to see exactly what Googlebot sees when it crawls your page. Compare it to what you see in a browser.
3. User-Agent Switching
Use browser developer tools or extensions to visit your site with a Googlebot User-Agent string and compare the content.
Problems with manual methods:
- Time-consuming
- Easy to forget
- By the time you check, damage may already be done
Automated Detection with Webalert
The most effective approach is continuous, automated monitoring.
Webalert's SEO Cloaking Detection feature:
- Fetches your page as a regular browser (standard User-Agent)
- Fetches your page as Googlebot (official Googlebot User-Agent)
- Compares the DOM structure of both versions
- Alerts you immediately if they differ
This runs automatically at your configured check interval, so you're protected 24/7—not just when you remember to check manually.
How Webalert's Cloaking Detection Works
Our detection goes beyond simple text comparison. Here's the technical approach:
DOM Structure Hashing
Instead of comparing raw HTML (which would trigger false positives from dynamic content like timestamps), we:
- Parse both page versions into DOM trees
- Extract the structural elements (tags, hierarchy, key attributes)
- Generate a cryptographic hash of the structure
- Compare the hashes
This means we detect when the page structure differs between browser and bot views—the hallmark of cloaking—while ignoring normal dynamic content variations.
Googlebot User-Agent
We use the official Googlebot User-Agent string that matches what Google actually uses for crawling:
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
This ensures we see exactly what Google sees.
Instant Alerts
When cloaking is detected, you get immediate alerts through your configured notification channels:
- SMS
- Slack
- Discord
- Microsoft Teams
- Webhooks
Every minute counts when your site is compromised.
Setting Up SEO Cloaking Detection
SEO Cloaking Detection is available on the Business plan. Here's how to enable it:
- Go to your monitor settings (create a new monitor or edit an existing one)
- Enable "SEO Cloaking Detection" in the Advanced Settings section
- Set your check interval (we recommend 5-15 minutes for critical pages)
- Configure notifications so the right people are alerted
That's it. Webalert handles the rest automatically.
Which Pages to Monitor
Focus on:
- Homepage — The most common target for cloaking attacks
- High-traffic landing pages — Attackers prioritize pages with good rankings
- Money pages — Product pages, checkout, pricing (especially valuable to attackers)
- Blog posts ranking well — Long-tail content is often targeted
You don't need to monitor every page—focus on the pages where cloaking would hurt most.
What to Do If Cloaking Is Detected
If you receive a cloaking alert, act fast:
1. Verify the Alert
Use Google Search Console's URL Inspection tool to confirm what Googlebot sees.
2. Investigate the Source
Check:
- Recently installed or updated plugins/themes
- File modification dates on your server
- Access logs for suspicious activity
- Database for injected content
3. Clean the Infection
- Remove malicious code
- Update all plugins, themes, and CMS
- Change all passwords (admin, FTP, database, hosting)
- Consider restoring from a known-clean backup
4. Request Review
After cleanup, use Google Search Console to request a review if your site was flagged.
5. Prevent Recurrence
- Keep all software updated
- Use strong, unique passwords
- Enable two-factor authentication
- Consider a web application firewall (WAF)
- Keep cloaking detection enabled to catch any future attempts
FAQ
Does cloaking detection slow down my website?
No. The detection happens on Webalert's servers, not yours. We simply fetch your page like any other visitor would—there's no impact on your server performance.
Will this detect all types of hacks?
Cloaking detection specifically catches attacks where content differs between browser and bot views. For comprehensive security, combine it with:
- Regular security scans
- Uptime monitoring
- Content change detection (for defacement)
- SSL certificate monitoring
What if I intentionally serve different content to bots?
Legitimate uses like serving mobile vs. desktop versions are handled by responsive design, not User-Agent cloaking. If you're doing legitimate bot-specific serving (like showing a "Please enable JavaScript" message), you may get false positives. In that case, you can adjust your setup or disable cloaking detection for that specific page.
How is this different from DOM change detection?
DOM change detection alerts you when your page structure changes between checks (comparing today vs. yesterday).
SEO cloaking detection alerts you when your page structure differs between two simultaneous fetches—one as a browser, one as Googlebot.
Both are useful for different threats.
Protect Your Site Today
SEO cloaking attacks are insidious because they're invisible to normal monitoring. Don't wait until Google flags your site and your rankings disappear.
Start monitoring with Webalert and enable SEO cloaking detection on your critical pages.
See all features on our features page or compare plans on pricing.