Cloaking
Cloaking means showing search engines different content from what real visitors see, usually by detecting the crawler's user agent or IP address. It is an explicit guidelines violation and one of the few tactics that reliably earns a manual penalty from Google.
Why it matters for your rankings
Cloaking breaks the basic contract of search: that the page Google indexed is the page a person gets. Google treats it as deliberate deception and penalises it accordingly, often with full removal rather than a ranking demotion.
The complication is that cloaking is frequently accidental or hostile rather than intentional. Compromised WordPress installations commonly serve spam pages only to Googlebot, so the owner sees a normal site while search results fill with pharmaceutical listings. Aggressive geo-redirects, paywalls that hide everything from users but not crawlers, and misconfigured bot detection can all trip the same wire. This is why comparing what Googlebot sees against what a browser sees belongs in every technical audit, not just ones where foul play is suspected.
How to check it on your site
Fetch as Google
Use URL Inspection in Search Console, then 'View Crawled Page'. Compare that HTML against what you see in a normal browser.
Check for a hacked site
In Search Console open Security Issues. Also search Google for site:yourdomain.com plus unrelated commercial words to expose injected spam pages.
Test with a spoofed user agent
Crawl your site in Screaming Frog with the user agent set to Googlebot, then again as Chrome. Compare word counts and titles for unexplained differences.
Review paywall and geo logic
If you restrict content, use Google's approved flexible sampling and structured data rather than hiding content from users only.