Cloaking & SEO Poison Scanner

Cloaking shows different content to search engines than to users. It's a blackhat SEO technique that violates Google's guidelines. Sites caught cloaking can be penalized or completely removed from search results. It's considered deceptive because it manipulates search rankings by showing optimized content to crawlers while showing different (often low-quality or malicious) content to real users.

Yes, when used for legitimate security auditing and defensive purposes. You should only scan websites you own or have explicit permission to test. Using this tool to detect if your own site has been compromised is perfectly legal. However, using findings to engage in blackhat SEO yourself is illegal and unethical.

The tool compares content similarity between Googlebot and normal user agents. Legitimate sites should have >95% similarity. However, some legitimate techniques (A/B testing, personalization, geo-targeting) can trigger false positives. Always review findings manually and consider the context. A low similarity score doesn't automatically mean cloaking — it means further investigation is needed.

First, review the findings carefully to determine if they're false positives. If you confirm malicious code: (1) Take the site offline immediately, (2) Change all passwords, (3) Remove malicious code, (4) Update all software/plugins, (5) Scan for backdoors, (6) Restore from a clean backup if needed, (7) Consider hiring a security professional. After cleaning, submit a reconsideration request to Google if you were penalized.

Yes. If you have evidence of cloaking or other blackhat techniques, you can report it to Google via their spam report form. Document your findings with screenshots and detailed evidence. However, be absolutely certain before reporting — false accusations can backfire. Remember that some techniques that look suspicious may be legitimate (e.g., personalization, mobile optimization).

If the tool detects redirects to risky file types (.exe, .apk, .sh, etc.), it automatically downloads them for analysis. Files are quarantined in a safe directory and never executed. The tool calculates file hashes (SHA256, MD5) and provides VirusTotal links so you can check if they're malicious. This helps identify malware distribution networks and compromised sites.

Common indicators include: hidden iframes loading external content, base64-encoded JavaScript, eval() or Function() calls, suspicious redirects to external domains, meta refresh tags, CSS cloaking (hidden text), obfuscated code, and unexpected file downloads. If you see multiple high-severity findings, your site may be compromised.

For high-value sites, scan monthly or after any major updates, plugin installations, or security incidents. For smaller sites, quarterly scans are sufficient. If you've been hacked before, increase frequency to weekly until you're confident the site is secure. Also scan immediately if you notice unusual traffic patterns, ranking drops, or security warnings.