Cloaking is a hacking concealment technique where administrators are shown a clean website while search engine crawlers (such as Googlebot) are served malicious content. Attackers leverage the reputation of legitimate corporate resources to promote spam and phishing. According to the ENISA Threat Landscape 2025 report, phishing remains one of the key vectors for gaining initial access to systems.
Industry implications
For businesses and website owners, undetected cloaking results in severe search engine penalties, blacklisting, and a dramatic loss of organic traffic. By exploiting a legitimate site's reputation to distribute spam and phishing, attackers compromise user trust and can facilitate broader corporate network intrusions, highlighting the critical need for robust security readiness.
How cloaking works and its forms
The mechanism relies on dynamic server-side content delivery. A malicious script analyzes the metadata of the HTTP request before generating the page, focusing on the following parameters:
- User-Agent: checking for search engine crawler signatures.
- HTTP Referer or device type: triggering redirects only when a user visits from search engine results or mobile devices.
The compromise most commonly manifests in two forms: injecting hidden links or text into legitimate pages (Content Injection) or creating new spam pages generated on the fly (Page Injection).
Diagnostics via Google Search Console
The Google Search Console (GSC) dashboard acts as an effective indicator of compromise. The primary indicator is the Security Issues report, which displays warnings about hacked content. For a detailed check, the URL Inspection tool is used, allowing you to view the page as Googlebot sees it.
Verification algorithm:
- Copy the suspicious URL from the Security Issues report.
- Paste the address into the search bar at the top of GSC.
- Click "Test Live URL" to initiate a real-time request.
- In the "HTML" tab, review the source code generated by the server for the bot.
- Compare the retrieved code with the code of the same page in a standard browser.
Discrepancies in the code and the presence of third-party links indicate that cloaking is being used.
Localizing malicious code and preserving evidence
Attackers typically place redirect rules in web server configuration files (.htaccess for Apache or nginx.conf for Nginx) or in CMS initialization files (e.g., index.php). You should look for obfuscation functions in the code, such as eval(), base64_decode(), and gzinflate().
To preserve evidence of the malicious code's operation, it is recommended to capture the server's HTTP responses using the curl utility, simulating a request on behalf of Googlebot:
curl -I -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://your-site.com/suspicious-page
The importance of addressing the root cause
A common mistake is simply deleting the spam files and submitting a review request in GSC. Console warnings are merely a symptom. Without patching the structural vulnerability in the backend, attackers will quickly restore the malicious scripts. According to the Cisco Cybersecurity Readiness Index 2025, only 27.7% of organizations have a sufficient level of readiness for modern cyber threats, highlighting the need for a comprehensive approach to security.
What to do
To clean your website and prevent reinfection, follow these practical steps:
- Run GSC diagnostics: Use the URL Inspection tool to compare the HTML served to Googlebot against the live browser view to identify discrepancies.
- Audit server configurations: Inspect .htaccess, nginx.conf, and CMS index files for unauthorized modifications and obfuscated functions like eval() or base64_decode().
- Preserve evidence: Use curl to simulate Googlebot requests and capture HTTP headers before making changes.
- Patch the root vulnerability: Identify how the attackers gained access (e.g., outdated plugins, weak credentials) and secure the backend before requesting a Google review.
Prepared by a Software Ukraine member. Original publication.