Inconclusive
The two views could not be compared.
One side never returned usable HTML, the surfaces contradicted each other, or every identity was refused. This is not clean and not cloaking. Repeat the scan.
Reading a report
What your result means
CloakScan will not invent a middle. If the visitor view and the crawler view cannot be compared, the verdict is inconclusive — not clean. That is the most common free-scan outcome on sites behind a WAF.
The four verdicts
Every cloaking check closes as one of these. Surfaces that disagree are not averaged into a fake score.
Clean
Visitor and crawler looked similar enough.
No cloaking signal crossed the threshold on this run. It is a dated observation, not a warranty that the site stays clean tomorrow.
Suspicious
There is a difference worth checking.
Not yet a confirmed spam payload. Look at identity, redirects, and whether the split is legitimate personalisation.
Cloaking
The scan found a meaningful split.
Treat it as an incident. Keep both renders, the status codes, and the redirect chain, then inspect origin, CMS, CDN, and Google’s index.
Why free scans land on inconclusive
The scanner is not Google. A rule that blocks datacenter IPs or a spoofed Googlebot string will stop the crawler side before there is a page to compare.
HTTP 403
The crawler-shaped request was refused. A “block fake Googlebot” rule, basic auth, or a country/ASN deny can do this. A 403 is a gate, not proof the site is clean.
WAF or bot fight
Cloudflare, a host WAF, or Bot Fight Mode served a challenge instead of the page. The scanner looks like a datacenter. Real users and verified Googlebot may still see the site.
Empty or challenge body
Status 200 with almost no words, a CAPTCHA, or a JS wall. There is nothing honest to diff against the browser view, so the verdict stays inconclusive.
Longer technical version: why faking a Googlebot User-Agent is not a real test — including IP and ASN gates that a header swap never sees.
What to do next
- 1. Run the same URL again. A one-off challenge page is common. Two identical inconclusives usually mean a standing WAF rule.
- 2. In Cloudflare or the host WAF, look at Bot Fight Mode, “block fake bots,” and skip rules that target datacenter ASNs. Those settings explain most 403s.
- 3. Do not close the ticket as clean. Check Google’s index for pharma, casino, adult, or crypto URLs under the domain. A blocked scanner and indexed spam can both be true.
- 4. If the browser view is a real page and Googlebot received something else, that is a finding — not inconclusive. Keep both renders.
Common questions
If you just got inconclusive
Is inconclusive a failed scan?
No. It is an honest stop. CloakScan will not call a site clean when one identity never returned a comparable page. That protects you from a false all-clear.
Why do so many free scans come back inconclusive?
Free scans often hit sites behind Cloudflare or a host WAF. Those layers block datacenter ASNs and spoofed Googlebot strings. The result is a 403, a challenge page, or an empty body — exactly the cases that cannot be scored as clean or cloaking.
Should I treat inconclusive as clean?
No. You did not get a comparison. If Search Console or a site: search still shows casino, pharma, or adult URLs under the domain, keep investigating. Indexed spam with a clean browser view is still cloaking.
What should I do next?
Run the scan again. If it repeats, check Bot Fight Mode, WAF skip rules, and any “block fake bots” setting. Allowlisting is a Studio conversation, not a free-scan toggle. Then compare what Google already indexed with what a normal browser shows.
How is this different from suspicious or cloaking?
Suspicious and cloaking both mean CloakScan compared two real pages. Inconclusive means it could not. A visitor error page next to Googlebot spam is a finding, not inconclusive.
Try another URL
Inconclusive on one site does not mean the tool is empty.
Paste a public URL, or start a trial. A 403 is a gate. A real split is a finding. Neither is a silent pass.