Malware
Cloaking
Cloaking is serving one version of a page to search crawlers and scanners and another to real visitors. Attackers use it so a hacked site looks clean to Google while sending people to spam or malware.
How it is measured
You catch cloaking by comparing what different clients receive. Fetch the same URL with a normal browser user agent, then as Googlebot, then with a referer from a search result. Differences in HTML, redirects, or injected script are the proof. Search Console's URL inspection also shows the crawler's view.
Cloaking often checks the user agent, IP range, or referrer. A scanner that fetches once from a datacenter address can miss it, so test from a residential connection with a Google referer too.
Worked example
A recipe blog owner searches their own site name and sees Google snippets for pills and casino links. Visiting the site directly shows normal recipes. Fetching a recipe URL with `User-Agent: Googlebot` returns a 40 KB page full of spam links; the normal fetch returns 18 KB.
The cause is a block added to `functions.php` that tests for crawler names and echoes the spam. Removing it and requesting reindexing brings the snippets back.
How it differs
Cloaking hides by showing different content to different clients. A doorway page is a page built to rank for a phrase and push people elsewhere, and it may or may not cloak. Cloaking is the delivery trick. A doorway is the content strategy. Hack Check weighs the Tarsier Threat Index hosts it finds, but a cloaked payload may only reveal itself under the right referrer.
Common errors
Checking your own site only while logged in as admin. Fetching with curl and no referer. Trusting a scanner that makes a single request. Reading the snippet in Google but not diffing the HTML. Treating legitimate geo-targeting or A/B tests as cloaking, or vice versa.
In practice
Once a month, fetch your top landing pages three ways: plain browser, Googlebot user agent, and with a search referer. Diff the bytes. Any difference you did not build is a red flag, and the next stop is your theme and plugin files for conditions on user agent or referer.