1
Dual crawl
Visitor versus Googlebot on the same URL. HTML, redirects, status, and rendered screenshots.
Case study
WordPress served spam only to Googlebot
Visitors got the real site. Google got casino and pharmacy pages. A file scanner stayed green. The dual crawl showed both faces on the same URL.
Anonymized incident · One of 17 cloaking attacks found across 450+ scans
Visitor
The homepage the owner and the client both saw in a normal browser.
Googlebot
Casino and pharma pages on the same URL, served only when the request looked like a crawler.
Client identifying details removed. The split above is the visitor-versus-crawler pattern CloakScan records on this kind of incident — the same dual view as the product demo.
What happened
A clean homepage is not a clean Google result
The site was WordPress. In a normal browser it looked like a local business. No spam in the nav, no casino pop-up, nothing a client would screenshot and send in a panic.
Googlebot received a different document. Titles, links, and
money-pages pointed at pharmacy and gambling content. That is why
a plugin that reads
wp-content
can stay green: the second page is often a rule, not a file.
CloakScan compared a real browser session with a Googlebot identity on the same URL, kept both renders, and flagged the mismatch. An index check then showed the leftover: spam URLs already sitting under the domain.
What the report answers
Three checks, one verdict
2
WordPress content
Public REST API for injected posts and pages a homepage crawl will miss.
3
Google index
Pharma, casino, adult, and crypto URLs already ranking under the domain after a “cleanup.”
Longer technical versions: the pharma hack and why a clean plugin scan can sit next to indexed spam.
See both faces
Your client still sees the homepage. Google may not.
Paste a URL, or start a trial. 450+ scans run. 17 cloaking attacks found. No plugin.