Cloaking

Also called content cloaking, user-agent cloaking

Presenting one version of a page to a crawler and a different version to a person. Google treats it as a spam policy violation, and the sanctions are manual and severe: the site can be removed from the index rather than demoted.

Detection is by user agent, by IP range, or by both. The classic form is a page of keywords served to Googlebot and a thin sales page served to everyone else. That version is rare now and easy to catch.

The mistake

Assuming the test is intent. It is not, and this is where well-meaning engineering walks into it.

The rule is about whether the crawler's copy represents the user's experience. Three common setups fail that test without anyone deciding to cheat.

Dynamic rendering, which sends a prerendered copy to bots and a client-rendered application to browsers, is fine while the two match and is cloaking the moment they drift. Nothing enforces the match, and only one of the two paths gets looked at. See prerendering for why serving one version to everyone removes the argument entirely.

Geographic or device redirection that treats crawler addresses as one country, while users see something else, produces the same mismatch. So does a paywall that opens for a recognized crawler and closes for everyone, unless it is declared through the structured data intended for that purpose.

The safe position is boring. Serve the same content to every requester, vary only the things that are not content, and declare any difference that is genuinely necessary through a documented mechanism.

If you need to hide something from search, hide it from everyone: noindex removes a page, an X-Robots-Tag header does the same for a file, and a 403 refuses the request outright. All three are honest. None of them depend on the crawler failing to notice.