Manual action recovery

Cloaking and Sneaky Redirects - Manual Action Recovery

Google has found that your site is showing its crawler one thing and your visitors another, and whether that was deliberate or something you knew nothing about, we track down the cause, remove it and get the action lifted.

Free recovery brief · Written diagnostic · Fixed quote before booking

Cloaking and sneaky redirects illustration

Is this the message in your Search Console?

Google’s Manual Actions report ↗

Search Console / Report example

Manual actions

Cloaking and/or sneaky redirects (this page also covers Sneaky mobile redirects and Cloaked images)

WHAT IS A CLOAKING AND SNEAKY REDIRECTS MANUAL ACTION?

Cloaking is the practice of presenting different content to search engines than you present to people, and a sneaky redirect is one that sends a visitor to a different page than the one Google saw, so this manual action means a reviewer has compared what Googlebot gets from your site with what a real person gets and found that they don't match. Google also issues two closely related actions which we deal with in the same way, the first being sneaky mobile redirects where only visitors on a phone are sent somewhere else, and the second being cloaked images where the image shown in Google's results is different to the one on your page.

WHAT DOES IT DO TO YOUR SITE?

Google treats cloaking as one of the more serious violations because it's a direct attempt to deceive both the search engine and the user, so the affected pages are demoted or removed and the action can cover the whole site. The difficult part for a lot of site owners is that they genuinely had no idea it was happening, because the redirect or the cloaked content only shows up under certain conditions that they never see when they look at their own site.

Scope: Affected URLs and redirects
Typical clean-up time: Estimated after diagnosis
Review time: Several days or weeks

WHY DID GOOGLE ISSUE IT?

Your server or CDN is configured to serve different HTML when the user agent or IP address belongs to Googlebot, which may have been set up on purpose by a previous developer or SEO

The site has been hacked and the attacker has added code that redirects visitors arriving from Google to gambling, pharmaceutical or adult sites while showing you the normal page

An advertising script or a third-party widget is redirecting mobile visitors to another site, which is one of the most common causes of the sneaky mobile redirects action and happens without the site owner's knowledge

You have paywalled or subscription content that Googlebot can read in full and visitors can't, and it hasn't been marked up with the paywalled content structured data that tells Google it isn't cloaking

Redirects have been set up that only fire for certain referrers, devices or locations, so that Google indexes one page and users land on another

HOW DO WE FIX IT?

We fetch the affected pages as Googlebot using the URL Inspection tool and compare the rendered HTML with what a normal visitor gets on desktop and on mobile, arriving both directly and from a Google search result
Browser comparison
Evidence log · Cloaking and sneaky redirects
Affected URL or template
Action taken
Verification date
We go through the server configuration, the .htaccess file, the CMS, the plugins and the JavaScript looking for anything that changes its behaviour based on user agent, IP address, referrer or device
Conditional delivery inventory
Evidence log · Cloaking and sneaky redirects
Affected URL or template
Action taken
Verification date
We check the site for signs of compromise and, where it has been hacked, clean it and close the hole that let the attacker in
Script and redirect fixes
Evidence log · Cloaking and sneaky redirects
Affected URL or template
Action taken
Verification date
We remove third-party scripts one at a time and retest where a mobile redirect is involved, which is the method Google itself recommends for finding the script responsible
Device-by-device retest
Evidence log · Cloaking and sneaky redirects
Affected URL or template
Action taken
Verification date
We confirm the fix across every affected template, add paywall markup where that was the cause, and then write and submit the reconsideration request
Submission record
Evidence log · Cloaking and sneaky redirects
Affected URL or template
Action taken
Verification date

WHAT GOES INTO THE RECONSIDERATION REQUEST?

The request explains what was serving different content, how it got there, what was removed and how we verified that Googlebot and visitors now see the same thing, and where the cause was a hack or a third-party script we say so plainly and include the evidence, because a reviewer will treat a site that was abused very differently to one that set out to deceive.

Reconsideration request service →

Questions about recovery

I never set up any cloaking, so why have I got this?

In a large share of cases the site owner didn't do it, and the cause turns out to be a hack, a rogue plugin or an ad network script, which is why the first job is always to find out what is producing the different content before anything gets changed.

Is showing different content on mobile cloaking?

No, adapting the layout or redirecting mobile users to an equivalent mobile page is fine, the problem is sending them to different content that the crawler never sees.

How long does recovery take?

Your diagnostic will include a clean-up estimate, and Google’s review usually takes several days or weeks, with link reviews sometimes taking longer.

Start your recovery brief