How to Tell If a Landing Page Is Cloaked: 7 Signals

What does a cloaked landing page look like on first load?

On first load, it usually looks too plain for the ad that sent you there. The page may wear a blog skin, a news skin, or a generic template while the ad promised a product, quiz, calculator, or checkout path. If the page only becomes meaningful after the first click, the first load was just camouflage.

The browser bar and the ad copy matter more than most people admit. If the title tag, H1, and visible claim point in different directions, log it. That still does not prove cloaking. It means you have enough friction to justify a second probe.

Check whether the page hides the real destination behind script-loaded content, a modal, or a second hop. If the HTML is lean but the rendered page looks busy, or the reverse, you need to compare what the server sent with what the browser painted.

Which seven signals separate a whitepage from a real lander?

The seven signals are not magic. They are a stack of small mismatches: title and H1 drift, thin body copy, a whitepage skin, hidden offer path, response changes across probes, weak trust pages, and tracking that mutates by source. If 3 or more appear together, treat the page as suspicious until you reproduce it from another vantage.

A page with one oddity can just be bad design. A page with four oddities is a pattern.

How do you compare responses across user agents and geographies?

Compare at least 3 views: a normal desktop browser, a mobile user agent, and a request from a different IP class. If you can only do one thing, change the IP class first. Cloaked setups often decide before the page renders, so headers and redirect chains matter as much as the screen.

What to compare first

• Send the same URL with and without a believable referrer.
• Keep cookies off for the first pass, then repeat with a fresh browser profile.
• Record every redirect, not just the final URL.
• Check the raw HTML and headers, then open the rendered page.
• Repeat from a residential connection and a datacenter-style probe if you have both.

A single datacenter probe tells you almost nothing about how the page treats a paid click. Cloud-side spy runs are good for collection, not for proof.

The browser is the last witness.

Why does the ad creative rarely match the page it points to?

A mismatch between the ad and the page is common, and it is not, by itself, cloaking. Direct-response teams run different headlines, different lead angles, and different layouts all the time; the ad sells the click, then the page sells the next step. Per Meta's advertising policies and the FTC's endorsement guides, the issue is whether the destination misleads, not whether the creative and the landing page look alike.

That is the part people fight about. The same offer can open as a quiz, a calculator, a case study, or a long-form page and still be honest if the offer, terms, and disclosures stay consistent. What changes the diagnosis is conditional serving. If a reviewer, a bot, or a datacenter IP gets one path and the real click gets another, the visual mismatch becomes evidence instead of noise.

Cosmetic contrast is common.

A page that looks off-brand is not automatically cloaked. A page that changes because of who asked for it is.

How do you rule out A/B tests and dynamic content before calling it cloaking?

Before you call cloaking, rule out the normal machinery of marketing. A/B tests, geo-localization, cookie-based personalization, consent overlays, and server-side experiments can all change what you see without changing the offer itself. The test is not whether the page varies. The test is whether the variation tracks a user attribute that should not matter.

• Different language or currency by country can be normal.
• Different headline by traffic source can be normal if the offer stays the same.
• Different legal disclosure for a state can be normal.
• Different product, different domain, or different checkout only for ad traffic is not normal.
• Different assignment on every refresh is usually a bug, not a clean split.

Cookies explain a lot.

A debt relief ad that shows a calculator to one browser and a generic article to another is not automatically cloaking if both paths hit the same disclosures, the same contact form, and the same offer. If the article exists only for the reviewer and the calculator only for the user, you have enough to document and stop.

What can you verify without touching the advertiser's systems?

Without access to the advertiser's systems, you can still verify the public surface. The Meta Ad Library is useful for creative history, launch timing, and whether an account keeps rotating angles after a review hit. AdSpy's published pricing tells you it sells access to ad collection, not certainty. None of these tools can prove what every visitor sees.

What you can check is the page as published: title tag, meta description, canonical URL, redirect chain, asset hosts, trackers, visible disclosures, and whether the HTML changes when you alter the probe. You can also note whether the page loads scripts from the same domain as the offer or from a separate tracker stack. You cannot prove hidden intent from one vantage. You can only prove that the public surface behaves differently under different conditions. That is enough for triage. It is not enough for certainty.

Public does not mean stable.

When does verification stop being research and start being a policy problem?

It stops being research when the differences are repeatable and material. If the page serves different offers, hides disclosures, gates access by referrer, or treats datacenter IPs as reviewers and residential clicks as customers, you have a policy problem, not just a note. At that point, preserve evidence and stop poking at the page.

• Save timestamps, headers, and raw HTML.
• Keep the original ad screenshot beside the landing-page capture.
• Note user agent, IP class, country, and referrer.
• Hand it to platform policy or compliance if you are inside the advertiser's org.

Under Meta's advertising policies, misleading destination behavior can sink a campaign fast. Under the FTC's endorsement guides, if the page uses testimonials or endorsements, disclosure failures add another layer. If you are outside the org, document the pattern and move on. Research ends where access control begins.

Frequently asked questions

Is a whitepage always cloaked?

No. A whitepage can be a pre-sell, a compliance wrapper, or a lazy template. It becomes cloaking only when the page changes based on the visitor's source, location, or browser context.

What is the fastest test for cloaking?

Compare the same URL across 2 user agents and 2 IP classes. If the HTML, redirect chain, or visible offer changes only for the ad-like probe, you have a strong signal. One screenshot is too weak to use alone.

Does Meta Ad Library prove cloaking?

No. It shows public creative history and activity, not the hidden serving logic. Use it to spot timing and angle changes, then verify the landing page yourself.

Should you trust archived landing pages?

Use them as clues, not verdicts. Archives can show what a crawler saw at a point in time, but they do not tell you how the page behaves for a live click from a different network.

Sources

Named rather than linked — verify before relying on any figure below.

• Meta's advertising policies
• FTC's endorsement guides
• Meta Ad Library
• AdSpy's published pricing