Cloaking is a subject that might not be known to everyone, but it is one of the oldest and most serious ways to get a site de-indexed or demoted in search results. It is also one of the easiest to do without realizing it. This guide will explain what cloaking is, why search engines treat it as a serious offense, and how to avoid doing it by accident in this new era of AI crawlers and dynamic content.
So what is cloaking, exactly?
Cloaking is considered a modern online scam. It means showing a human one thing and showing the search engine's crawler something else. Let's say that you sell shoes, when someone lands on your page, they get to see your best sellers and new collections. But to the bots, you also feed clothes, bags, sports gear, anything with search traffic behind it, so you turn up in a lot more results that you should not. That is cloaking. You are dressing the page up for the crawler because you know it is what forms the search result, not the page a human eventually reaches. That seeds mistrust, and search engines are wary of it.
The important part is what kind of difference we are talking about. Cloaking is not about showing two different versions of a page, but more about showing two different truths. A page can look completely different on a phone, a laptop, and a screen reader without any of that being cloaking, because the meaning underneath is the same. Cloaking is when the meaning itself changes depending on who, or what, is asking.
Cloaking is not showing bots a different version of your page. It is showing them a different truth.
Why do search engines punish it?
Search engines make a quiet promise to the people using them: the result you click will be the page you were shown and cloaking breaks that promise on purpose. If a crawler is told a page is about one thing, ranks it for that, and then a human arrives to find something entirely different, the search engine looks bad and the user leaves annoyed.
That is why the penalty is heavy. Google's own spam policies list cloaking as a violation, described as showing different content to search engines than to users in order to manipulate rankings (Google Search Central, spam policies). Getting caught does not earn you just a warning, it can cost you rankings across the board, and in clear cases it can pull the site out of the index entirely.
And the audience for this is growing. It is not just Googlebot reading your pages any more. The AI crawlers behind tools like ChatGPT and Perplexity fetch your content the same way, and the same rules apply to them, which is turning into its own discipline alongside classic SEO.
What does cloaking actually look like?
It usually boils down to one move: the server checks who is asking and changes the answer:
- Serving the crawler a page stuffed with keywords and text, while human visitors get something else entirely, whether that is a thin landing page, an image, or a redirect somewhere unrelated.
- Detecting Googlebot by its user-agent or IP address and quietly swapping in different content just for it.
- Hiding text or links that only a crawler will parse, written purely to rank rather than to be read by a person.
What ties them all together is intent. The site knows the crawler and the human will end up seeing different things, and it is counting on the human never finding out.
Where is the line between cloaking and just cleaning up?
This is where people tie themselves in knots, because plenty of legitimate things also hand slightly different bytes to bots and humans. Responsive layouts, A/B tests, localised content, paywalls, and pages rendered on the server for crawlers but in the browser for people are all normal. None of these are examples of cloaking on their own.
Stripping a page down for a machine is fine too. Imagine reading this article with random hieroglyphs scattered through it. The meaning is the same with or without them, they just make it harder to get through. That is what your nav bars, cookie banners, and tracking scripts are to a crawler, noise wrapped around the actual content. Removing that noise so a bot can read the real information does not change what the page says.
There is a simple test so don't panic. You can remove as much junk as you like. You cannot invent, hide, or swap a single claim. If the meaning a crawler takes away matches the meaning a human takes away, you are cleaning up and if it does not, you are cloaking.
So where do SSR and CSR come into this?
It helps to know the two ways a page gets built, because this is exactly where honest sites accidentally start to look suspicious. With server-side rendering, or SSR, the server hands over a finished page, so a crawler and a person both get the full content the moment they ask. With client-side rendering, or CSR, the server sends a nearly empty shell and the visitor's browser assembles the page with JavaScript. A human never notices the difference, but a crawler that does not run that JavaScript(and plenty of the AI crawlers do not) can arrive to find almost nothing there.
None of that is cloaking. There is nothing misleading about it, just a rendering choice that happens to leave some bots reading an empty room. The trouble starts when someone tries to patch the gap by checking if what is looking at a site is a crawler and handing it a special version. The moment that special version says anything the human version does not, a visibility problem has quietly turned into a cloaking one. The fix is to get the content to everyone, usually by rendering it on the server, without ever branching on who is asking.
How do you avoid cloaking by accident?
Most accidental cloaking comes from branching your content on who is asking, so the safest habit is to never serve different primary content based on user-agent or crawler IP. If your site genuinely renders differently for bots and browsers, for example a heavy single-page app that pre-renders a version for crawlers, make sure both roads end at the same place: the same headings, the same links, the same claims.
FAQ
Is every difference between the bot version and the human version cloaking?
No. Only a difference meant to mislead the search engine counts. Responsive design, personalisation, paywalls, and stripping boilerplate are all fine as long as the meaning of the page stays the same for the crawler and the human.
What is the penalty for cloaking?
It is a spam-policy violation. It can cost you rankings across the board and, in clear cases, get the site removed from the index (Google Search Central).
Is serving a stripped-down page to crawlers cloaking?
Not if the meaning is identical. Removing navigation, banners, and scripts is fine. Changing, hiding, or swapping what the page actually says is where it becomes cloaking.
Is dynamic rendering cloaking? My site is JavaScript, so bots get a pre-rendered version.
No, as long as both versions carry the same content. Serving crawlers a pre-rendered HTML copy while people get the JavaScript app is a recognised technique, and Google says it does not count as cloaking when the crawler and the visitor end up with the same thing. It only crosses the line if the pre-rendered version says something the human version does not.
Is hiding content in tabs or accordions cloaking?
No. Cloaking is content written to be read only by a crawler, like white text on a white background. Text tucked into a tab or an accordion is still there for the visitor the moment they click, so it is a design choice, not a way to mislead. Google can read it fine, though it has historically given collapsed content a little less weight, which is a ranking question, not a cloaking one.
Is showing visitors different content based on their location cloaking?
Not on its own. Serving a French visitor French content is normal. It tips into cloaking when you detect the crawler specifically and feed it something a real visitor in that location would never see. The safe pattern is to give each version its own URL and never single out the bot for special treatment.
Full disclosure: keeping that line, serving AI crawlers a clean page without ever changing its meaning, is the problem we happen to work on at Ooky.
Sources
- Google Search Central. "Spam policies for Google web search: Cloaking." Retrieved 2026-07-14. https://developers.google.com/search/docs/essentials/spam-policies#cloaking
- Google Search Central. "Dynamic Rendering as a workaround." Retrieved 2026-07-14. https://developers.google.com/search/docs/crawling-indexing/javascript/dynamic-rendering