How cloaking works
A server can tell a good deal about who is asking for a page: the user agent string, the IP address, the referring source, whether JavaScript runs. Cloaking uses one of those signals to branch. When the request looks like a search crawler it returns keyword-heavy text; when it looks like a person it returns something else — a thin sales page, a redirect, an advert, sometimes a different site altogether.
The branch does not have to be crude. Text stacked invisibly behind an image, content served only to visitors from one country while the crawler in another sees the full page, or a script that rewrites the body after the crawler has taken its copy, all reach the same end. The indexed version and the visited version do not match.
Why cloaking matters
Search engines index what they are shown and then rank it on behalf of people who will see something different. That breaks the basic bargain, so it is treated as a spam policy violation rather than a technical mistake. The consequence is not a gentle ranking adjustment — it is a manual action, and the pages or the whole site can be removed from results while it stands.
It matters commercially because recovery is slow. Getting back in means removing the mechanism, proving it is gone and waiting for a reconsideration review, and any rankings the cloaked pages held disappear in the meantime. Whatever those pages were feeding — enquiries, sales, brand searches — stops with them.
Where cloaking goes wrong
Most cloaking I find is not deliberate. A site puts its main content behind a login and serves the crawler the full article to stay indexed. A migration leaves an old rule that shows crawlers a legacy template. A developer sets up dynamic rendering for a JavaScript site and the rendered snapshot drifts out of step with what the browser builds. Intent does not protect you here; the test is simply whether the two versions match.
The deliberate version usually arrives with a supplier. Cheap ranking packages sometimes rely on cloaked doorway pages that redirect people onward to the real site, and the client learns what was done only when the traffic vanishes. Ask any agency directly whether anything on your site is served differently to crawlers, and expect a straight answer.
What to do about it
Fetch your important pages as a crawler would and compare them with what a browser renders. The URL Inspection tool in Search Console has a live test that shows Google the rendered HTML it received — read that HTML rather than skimming the screenshot. Where geo-targeting, device detection or personalisation exists, confirm the main content and the internal links survive every branch.
If you find cloaking, remove the rule rather than soften it, then check the manual actions report. Paywalls and member content have a supported route: mark them up honestly and show the crawler the same preview a first-time reader gets. Sorting this out belongs squarely inside technical SEO work, and it is worth doing before anyone spends on content or links that a policy violation would waste.