For WordPress

Cloaking checker for WordPress

Most WordPress “clean” results come from a plugin that reads files. Cloaking often never touches those files. CloakScan checks the site from the outside: visitor versus Googlebot, injected content, and the index.

Start a 15-day trial Run a free scan

No plugin · No wp-admin · No server access

What it answers

WP security plugin: Are known malware files or signatures on this WordPress install?
CloakScan: Does Googlebot receive a different page than a visitor?

Visitor vs Googlebot crawl

WP security plugin: No. The plugin scans from inside the site.
CloakScan: Yes. Every scan compares a real browser with a Googlebot identity.

WordPress plugin install

WP security plugin: Yes. You need wp-admin, and the client has to approve the plugin.
CloakScan: Never. Paste a URL. No plugin, no DNS, no credentials.

Injected posts and pages

WP security plugin: If the spam is a file or a known pattern the plugin already lists.
CloakScan: Yes. WordPress content scan via the public REST API.

Client sites without wp-admin

WP security plugin: You wait for access, or you skip the check.
CloakScan: You can scan from the outside the same day.

Continuous cloaking watch

WP security plugin: Malware schedules, not a crawler-versus-visitor comparison.
CloakScan: Yes. 6h, 24h, or 7-day cadence, with email and in-app alerts.

Google index spam

WP security plugin: Not a first-class check. A clean origin can still have indexed spam.
CloakScan: Yes. Index inspection for pharma, casino, adult, and crypto URLs.

Client-ready evidence

WP security plugin: Security logs focused on files and cleanup.
CloakScan: Dated score, dual screenshots, verdict, and monthly PDF.

Feature comparison of a WordPress security plugin and CloakScan
Capability	WP security plugin	CloakScan
What it answers	Are known malware files or signatures on this WordPress install?	Does Googlebot receive a different page than a visitor?
Visitor vs Googlebot crawl	No. The plugin scans from inside the site.	Yes. Every scan compares a real browser with a Googlebot identity.
WordPress plugin install	Yes. You need wp-admin, and the client has to approve the plugin.	Never. Paste a URL. No plugin, no DNS, no credentials.
Injected posts and pages	If the spam is a file or a known pattern the plugin already lists.	Yes. WordPress content scan via the public REST API.
Client sites without wp-admin	You wait for access, or you skip the check.	You can scan from the outside the same day.
Continuous cloaking watch	Malware schedules, not a crawler-versus-visitor comparison.	Yes. 6h, 24h, or 7-day cadence, with email and in-app alerts.
Google index spam	Not a first-class check. A clean origin can still have indexed spam.	Yes. Index inspection for pharma, casino, adult, and crypto URLs.
Client-ready evidence	Security logs focused on files and cleanup.	Dated score, dual screenshots, verdict, and monthly PDF.

“WP security plugin” here means the usual on-site stack: Wordfence, Sucuri, and similar file scanners. They are strong at malware. They are not an external cloaking checker.

Pick the right tool

Keep the plugin for files. Use CloakScan for what Google is shown.

Choose a plugin when

You need to clean or lock the install

A theme or plugin is infected and files must be removed.
You have wp-admin and want a firewall on that one site.
The question is “what is on disk?”, not “what does Googlebot get?”

Choose CloakScan when

You need a WordPress check without a plugin

Wordfence says clean, and Google still shows pharma or casino.
You manage client WordPress sites and cannot install on each one.
You need a dated visitor-versus-crawler report you can send.

Why the plugin result misleads

A clean wp-content is not a clean Google result

WordPress cloaking is often a rule, not a file. A dropped plugin, an edge rule, or a REST injection can serve spam to Googlebot and a normal homepage to you. The security plugin never sees the second page, because it is not asking as Googlebot.

CloakScan sends both identities, renders both, and keeps the screenshots. It also looks for injected posts through the public WordPress API, then runs an index check. The leftover after a cleanup is often in Google’s index, not in wp-content.

Longer versions: the pharma hack and why a clean plugin scan can sit next to indexed spam.

Before you pick

Common questions

Do I need to install a WordPress plugin?

No. CloakScan is an outside check. You paste the site URL. There is no plugin, no mu-plugin, no DNS change, and no wp-admin access.

Does this replace Wordfence or Sucuri?

No. Those plugins look at files, firewalls, and cleanup. CloakScan looks at what Googlebot is served versus what a visitor is served, then checks the index and public WordPress content. A green plugin scan and a dirty Google result can both be true.

Does it work if I do not have wp-admin?

Yes. That is the point for agencies and freelancers. You can check a client WordPress site the same day, without waiting for credentials.

Is this only for self-hosted WordPress?

Any public WordPress URL can be scanned. The dual crawl does not need the REST API. The extra WordPress content scan uses the public posts and pages API when it is available.

Check the WordPress view

The plugin cleaned the files. CloakScan checks what Google still sees.

Paste a WordPress URL, or start a trial and watch the next change. No plugin, no wp-admin.

Start free trial Run a free scan