Block Google Ads Infected With Cloaking

If you suspect your Google Ads account, campaigns, or website have been "infected" with cloaking, the short answer is: you cannot block cloaking with a single toggle. Cloaking is a deceptive technique, not a setting. To stop it you have to (1) confirm whether cloaking is actually present, (2) remove the malicious or deceptive code and any compromised ad assets, (3) secure the accounts and site that allowed it in, and (4) use Google's own reporting and review channels so the platform can act on the offending ads. Blocking happens through detection, cleanup, access control, and reporting — not through one button.

This guide explains what cloaking is in the Google Ads context, how to tell whether you are dealing with it, the concrete steps to block and remove it, and the limits of what you can and cannot control. It is written for everyday users and small advertisers, not for deep forensic or legal work.

What "Cloaking" Actually Means in Google Ads

Cloaking is the practice of showing different content to different visitors based on who they are, where they come from, or how they arrived. In advertising, the classic pattern is: a search engine crawler or a review system sees one page (often compliant and harmless), while real users — or users arriving from a specific source — see something else (often misleading, low quality, or policy-violating).

When people say their Google Ads are "infected with cloaking," they usually mean one of a few situations:

- A landing page they control is serving different content to Google's systems than to human visitors, sometimes because of injected code. - A third-party vendor, affiliate, or agency is running cloaked ads under their account or brand. - Their website has been compromised and now redirects or swaps content conditionally. - Someone is impersonating their brand with cloaked ads that point to a lookalike site.

Cloaking matters because it violates Google Ads policies and undermines trust. It can lead to disapproved ads, account suspension, wasted spend, and damage to your brand. It is also a security problem when it comes from compromised code, because the same access that injects cloaking can be used for other abuse.

How to Tell Whether Cloaking Is Present

You cannot fix what you cannot see. Before blocking anything, gather evidence. Cloaking is designed to hide, so you need to compare what different visitors receive.

1. **Compare user agents.** Load your landing page with a normal browser, then request the same URL with a search-engine crawler user agent (many browsers and developer tools let you change the user agent string). If the HTML, redirects, or visible content differ, that is a red flag. 2. **Compare referrers and sources.** Visit the page directly, then visit it by clicking an ad or arriving from a search result. Conditional redirects based on referrer are a common cloaking pattern. 3. **Check for unexpected redirects.** Watch the network activity in your browser's developer tools. Sudden redirects to unrelated domains, especially after a delay or a specific condition, suggest injected code. 4. **Review your ad destinations.** In Google Ads, confirm that every final URL and display URL matches the page you actually intend to send users to. Mismatches or recently changed URLs you did not make are suspicious. 5. **Audit account access.** Look at who has access to your Google Ads account, your website CMS, your hosting, and any tag managers. Unknown users, old API keys, or unfamiliar third-party tools are common entry points. 6. **Scan your site.** Use a reputable malware or integrity scanner and compare your site files against a known-good backup. Injected scripts, obfuscated JavaScript, and unfamiliar PHP files are typical signs of compromise. 7. **Check Search Console and ad diagnostics.** Google Search Console and Google Ads policy notifications can surface security issues, manual actions, or disapprovals that point to cloaking or compromised pages.

If several of these checks point the same way, treat it as a real incident rather than a false alarm. If only one weak signal appears, verify before taking drastic action.

Steps to Block and Remove Cloaking

Once you have reasonable evidence, work from containment to cleanup to prevention. The order matters, because cleaning a site while the attacker still has access usually just leads to reinfection.

1. **Contain access.** Change passwords for your Google account, Google Ads, hosting panel, CMS admin, FTP/SFTP, database, and any connected tools. Enable two-factor authentication everywhere it is offered. Revoke sessions and remove unknown users, API keys, and OAuth grants. 2. **Pause the affected campaigns.** Pausing stops spend and limits user exposure while you investigate. It does not fix the problem, but it buys time. 3. **Remove malicious or deceptive code.** Restore compromised files from a clean backup where possible, or remove injected scripts and redirects manually. Check theme files, plugins, .htaccess or server config, and any custom JavaScript. 4. **Fix the landing pages.** Make sure the page Google's systems see and the page users see are the same. Remove conditional logic that serves different content by user agent, referrer, IP, or geography unless it is a legitimate, disclosed use case. 5. **Review third parties.** If an agency, affiliate, or vendor had access, ask them directly what they are serving and how. Remove access from anyone you cannot verify. Cloaking is sometimes introduced by a partner rather than an attacker. 6. **Report to Google.** Use the in-product policy and security reporting channels, and respond to any account notifications. Reporting helps Google act on offending ads, including impersonation ads you do not control. 7. **Request a review if your account was affected.** If ads or the account were disapproved or suspended, fix the underlying issue first, then use the appeal or review process. Appeals work best when the problem is genuinely resolved. 8. **Monitor after cleanup.** Keep watching redirects, file integrity, ad destinations, and account access for a period after the fix. Reinfection is common when a backdoor remains.

What You Can and Cannot Control

It helps to be clear about boundaries, because "blocking" cloaking is partly within your control and partly not.

- **You can control:** your own accounts, your website and its code, who has access, your ad destinations, and whether you report problems. - **You can influence:** Google's enforcement, by reporting accurately and responding to reviews. - **You cannot directly control:** ads run by impersonators using their own accounts, or how quickly a platform acts on a report. You can report and document, but you cannot force a specific outcome or timeline. - **You cannot "block" cloaking with a single setting.** There is no switch that turns cloaking off. It is removed by fixing code, access, and content, and by using platform reporting.

Also note that some legitimate personalization — like showing different languages by region — is not cloaking. The line is deception: showing materially different content to reviewers or crawlers than to users, in a way that misleads.

Practical Next Steps

If you want to act today, start here:

1. Write down what you observed and when, with screenshots and URLs. 2. Change passwords and enable two-factor authentication on Google, hosting, and CMS accounts. 3. Pause affected campaigns to stop spend. 4. Run a malware/integrity scan and compare against a clean backup. 5. Remove unknown users, keys, and third-party access. 6. Fix or restore the landing pages so all visitors see the same content. 7. Report the issue through Google's channels and respond to any account notices. 8. Set a reminder to re-check redirects, files, and access in the coming weeks.

If you are not comfortable doing the technical cleanup yourself, involve a qualified web security professional. This guide is general information, not a substitute for hands-on incident response.

FAQ

Can I block cloaking with a setting in Google Ads?

No. Cloaking is a deceptive technique, not a feature you can toggle off. You stop it by detecting it, removing the deceptive or malicious code, securing account access, fixing your landing pages, and reporting the issue through Google's channels.

How do I know if my site is cloaking?

Compare what different visitors receive. Load your page normally, then with a search-engine crawler user agent, and from different referrers. If the content, redirects, or HTML differ in a way that hides something from reviewers or crawlers, that is a strong sign of cloaking. Unexpected redirects and injected scripts are also common indicators.

Will reporting cloaking to Google get the ads removed?

Reporting is the right step and helps Google act, but you cannot control the outcome or the timeline. Google reviews reports and policy issues on its own schedule. For your own account, fixing the underlying problem first and then using the appeal or review process tends to work better than appealing before the issue is resolved.

What if a third party or agency caused the cloaking?

Treat it as an access and trust problem. Ask the vendor directly what they are serving and how, remove access from anyone you cannot verify, and review your ad destinations and landing pages. Cloaking is sometimes introduced by partners rather than attackers, so auditing third-party access is essential.

Is all personalization considered cloaking?

No. Legitimate personalization, such as showing content in a visitor's language or region, is generally acceptable when it is not deceptive. Cloaking is specifically about showing materially different content to reviewers or crawlers than to users in a way that misleads. The key issue is deception, not personalization itself.