Docs

1. Getting started

CloakScan Studio is the dashboard. The public site is for explanation and a free one-off scan. Ongoing monitoring lives in Studio at studio.cloakscan.com.

Create a free account. Free includes one site and five manual scans per month, with no credit card required. Paid plans add scheduled monitoring and include a 15-day trial.
Open Sites, choose Add site, and enter a name and URL. No plugin, no DNS change, no server access. CloakScan works entirely from the outside.
Wait for the first scan to finish. Heavy pages can take a few minutes because both crawls render in a real browser.
Open the report. The score, cloaking verdict, and each check sit on the same page. That first result is the baseline, not a lifetime guarantee.

Enter your URL on the marketing site, create a free account, and run your first scan in Studio. Free includes one saved site, five manual scans per month, browser rendering, and scan history. Scheduled scans and alerts are available on paid plans.

2. Dual crawl

Every scan sends two visits to the same URL at the same time:

Visitor crawl: a normal Chrome browser, the way a person would load the page.
Googlebot crawl: the same URL with Googlebot identity, so the server can be tested on the gate attackers usually care about.

CloakScan compares HTML, redirects, status codes, rendered screenshots, and structured data (JSON-LD, Open Graph, canonical). A mismatch is a cloaking signal. Identical carousels, animations, or lazy-loaded images are not treated as a visual mismatch when the text of the page is the same.

In Studio, the Googlebot comparison tab shows the crawler view next to the visitor view. Use it when you need evidence, not a screenshot from your own laptop. Spoofing a User-Agent in the browser only tests one gate; the scan also exercises IP and rendering.

3. Reading a report

A report is a dated snapshot. It answers what CloakScan saw in that run, not whether the site will still be clean tomorrow.

Score (0–100): each finding deducts points. Read the deductions, not only the number. A high score with an inconclusive cloaking verdict is not “all clear”.
Cloaking block: the verdict, confidence, and the surfaces that agreed or contradicted each other.
Checks: SSL, Safe Browsing, security headers, SEO title and description, uptime, robots.txt, sitemap, evasion signals, hidden CSS content, structured data.
Screenshots: both renders open at full size. Keep them if you need to show a client or attach evidence to a cleanup.
AI summary: a short bilingual read of what is wrong and what to fix first. Use it as a briefing, then verify the URLs and diffs yourself.

When you send a report to a client, send the dated score, the verdict, and the two screenshots. The PDF exists for that. Do not start a cleanup by deleting random files: preserve the suspicious URL, timestamp, status, redirect chain, and both page versions first.

4. Verdicts

Cloaking resolves to one of four outcomes. Surfaces that contradict each other are not averaged into a fake middle.

Clean: visitor and crawler responses were similar enough that no cloaking signal crossed the threshold. It is a clean observation, not a warranty.
Suspicious: there is a difference worth investigating, but it is not yet a confirmed cloaking payload. Check identity, redirects, and whether the split is legitimate personalisation.
Cloaking: the scan found a meaningful split. Treat it as an incident: preserve evidence, then inspect origin, CMS, CDN, credentials, and Google’s index.
Inconclusive: the reading cannot be trusted. Typical cases: the two surfaces disagree, every identity is refused, or the page did not load for one crawler. Repeat the scan. A site nobody could read is never reported clean. Public explainer: what your result means.

An error page for visitors and a spam page for Googlebot is a finding, not a glitch. Pages prerendered for crawlers are told apart from failed readings and stay flagged.

5. Beyond the homepage

Cloaking is rarely only on the URL you pasted. Studio can look at what else an injection leaves behind.

Google index scan: queries Google’s index for spam URLs under the domain — pharma, casino, adult, crypto — including pages you never published. Monthly volume depends on the plan (8 / 24 / 56).
Sitemap insights: suspicious URLs are listed one by one, not only counted.
WordPress content scan: looks for injected spam URLs inside posts and pages, which a homepage crawl will miss.

After a cleanup, scan again and keep watching. Google may still show old spam while the index catches up. Separate a live payload from an indexed leftover.

6. Alerts and schedule

Monitoring is the difference between a checker and protection. Studio repeats comparable visitor and crawler checks so a change can wake someone up.

Cadence: 6 hours, 24 hours, or 7 days, with a per-site override. Match frequency to risk: a brochure site may need daily or weekly checks; ecommerce and client sites after an incident need a tighter loop.
Alerts: critical and warning findings go to email and the in-app inbox. Open the alert while the suspicious response is still available.
Manual scan: run one when a client reports a ranking drop, after a deploy, or after a cleanup. Manual runs can take up to 300 seconds on heavy sites.

The dashboard shows score trends, cloaking pressure, and coverage across the portfolio. Use it to see which sites have gone quiet, not only which ones failed today.

7. Badge and PDF

Two artefacts for people who will not log into Studio.

Public badge: an embeddable snippet with theme presets and layout options. Pro unlocks advanced customisation. Studio unlocks a white-label badge.
Monthly PDF: dated score, checks, and the AI summary. Studio plan reports can be white-labelled for client delivery.

The badge is a public signal, not a live cloaking test. If the site is compromised between scans, the badge will lag until the next run. Put the PDF on a cadence the client already expects (monthly reporting), and send an alert the same day when a critical finding appears.

8. Account

Plans: Starter (5 sites), Pro (25), Studio (75). The scan engine is the same. Limits that change are site count, Google index scans, and white-label options. See pricing.
Trial: 15 days on every plan. A banner in Studio shows when the 15 days begin.
Billing: Stripe handles cards. CloakScan never stores full card numbers.
Two-factor authentication: TOTP plus recovery codes. Turn it on from account settings.
Language and theme: English and Italian, light and dark. That switch is for Studio, not for the public site.
Support: open a ticket from the dashboard (technical, billing, alerts, feature requests) so the site, plan, and scan history stay attached. For a vulnerability in CloakScan itself, use responsible disclosure.

Product questions that are not a ticket: hello@cloakscan.com.