In short, a cloaker is a filter that sits between your ad and your website. Everyone who clicks the ad is checked first, and based on the result sees one of two pages: a targeted visitor gets the offer, a filtered-out one gets a neutral page. The technique of showing different content to different visitors is called cloaking. Historically, the term meant above all showing a platform's reviewers something other than what users see, and that use is exactly what ad platforms prohibit.
Below, without unnecessary jargon: what a cloaker actually checks, where the line runs between traffic filtering and breaking platform rules, who benefits from a filter and how to tell a good service from a token one.
What is cloaking, in plain terms
Picture a shop with a guard at the door. In a split second he can tell who is in front of him: a customer, someone handing out a competitor's flyers, or a robot vacuum that rolled in from the street. The customer goes into the store; everyone else goes to a waiting room where nothing is for sale. A cloaker does the same with clicks on an ad link.
Besides people, ad links get visited by:
- bots and auto-clickers — they inflate clicks, eat the budget and corrupt your stats;
- scanners and scrapers — they crawl addresses en masse from servers, collecting pages and links;
- spy tools — they harvest other people's creatives and landing pages so they can be copied;
- link preview bots — they fetch the title and image when a link shows up in a feed or messenger;
- competitors — they drop by to see what you are running;
- the platform's own review — automated and manual. It looks at the ad and the page it leads to and checks them against its policies.
Customers are ordinary people on a phone or computer who saw the ad and got interested.
Terms. An offer is the advertiser's proposal you get paid for when someone takes the target action (a lead, a purchase, a sign-up). A White Page (a safe page) is the neutral site that filtered-out visitors see. A Black Page (money page) is the page with the offer or pre-lander that the target audience sees.
Cloaking in affiliate marketing: what the term means for traffic
In affiliate marketing (often called traffic arbitrage) you buy ads on one platform and send people to offers from an affiliate network, earning the difference. Every click costs money, and every non-targeted click is a direct loss. So a media buyer (the specialist who buys traffic) uses a traffic filter mainly for three jobs:
- Saving budget. Bots, scanners and auto-clickers that never reach the offer do not create fake clicks in the offer stats and do not distort campaign optimization.
- Protecting the funnel. A funnel is the combination of source, creative, pre-lander and offer that makes a profit. A spy tool that sees a White Page cannot steal it. More on this in the article on protecting your funnels from spy tools.
- Clean data. When you can see who was filtered out and why, it is easier to judge a placement's quality and cut junk placements in time.
A word on what a filter is not. It does not make acceptable an ad the platform would not approve. The ad and its landing page must comply with the platform's policies — with the same requirements for the offer, copy and creative as any other ad. More on that below, in the section on legality.
How a cloaker works: from click to page
The mechanics are similar across modern solutions. The journey of one click looks like this:
- A person or a bot clicks the ad and lands on your landing page's address.
- The cloaker's code on that page (a JS tag or a PHP file) passes the visit data to the filtering service.
- The service collects signals: IP address, network and ISP, country, device type, browser, language, time zone, ad click parameters, browser behavior.
- Some signals reject the visit immediately (a known bot address, an obvious automated browser, the wrong country). The rest add up to a trust score.
- In the end the visitor sees the offer or the White Page, and the reason for the decision is logged.
The whole journey fits into a fraction of a second, and a real person notices nothing. How to install the code on your site is covered in how to install a cloaker.
Which signals the filter looks at
| Signal group | What is checked | Who it usually catches |
|---|---|---|
| Network | VPN, proxy, data center and hosting IPs, no ISP | Scanners, cloud bots, server-side scrapers |
| Lists | Addresses already caught automating | Repeat visits from bots and spy tools |
| Browser | Headless browser traits, JavaScript execution, fingerprint | Auto-clickers, scrapers, browsers pretending to be real |
| Audience | Country, device, OS, language, time zone, schedule | Off-target traffic, visits from the wrong geo |
| Ads | Presence of the platform's click ID (fbclid, gclid, ttclid and others) | Non-ad visits: forwarded links, direct visits |
| Behavior | How natural the interaction with the page is | Simple bots that do not behave like humans |
Network signals are covered in detail in VPN, proxy and data center IPs, and browser signals in headless browsers and fingerprinting.
Cloaker vs anti-bot vs tracker
These terms often get mixed up, so let's separate them.
- An anti-bot filters out automated traffic and usually just blocks it or shows a placeholder. It does not necessarily send different visitors to different pages.
- A cloaker is an anti-bot plus routing: it does not just block filtered visitors, it sends them to a set page and logs the reason for the decision.
- A tracker counts clicks, conversions, cost and profit and receives postbacks from affiliate networks. On its own it does not decide who goes where.
In practice these functions are increasingly combined in one service. What a tracker does and why you need one even with a good filter is covered in what is an affiliate tracker.
What a bot, a spy tool and a customer see: an example
Say you launch a campaign on a push network for an allowed online store offer. The ad leads to your landing page at https://your-site.com/.
- A link preview bot comes from a known address with a recognizable user agent. The filter identifies it immediately and shows the White Page.
- An auto-clicker from a junk placement arrives from a data center network through an automated browser. It gets the White Page, and you get a reason to block that placement in the network.
- A spy tool opens the link from a server IP, with no click ID, and its address is already on the list of caught bots. It gets the White Page, and your funnel stays yours.
- A person from the ad comes from a phone, on a residential ISP in the right country, with a click ID. They see the offer.
Every visit in the log has its own reason: "Search or platform crawler", "High-risk network", "Headless browser detected", "Allowed". The log is what separates a working filter from a black box: you see not just a filtered-out percentage but the logic behind each decision. How to read the reasons is explained in why a click went to the White Page.
What a cloaker cannot do
You cannot talk honestly about cloaking without its limits.
- A filter does not make an ad acceptable. Platforms evaluate the account, its history, payment method, creative, ad copy, domain, landing page and how people behave after the click (complaints, hides). If the offer or creative breaks the rules, a filter will not fix that, and trying to show reviewers a different page is a violation in itself.
- Overly strict rules cut real people. If you block everyone without a known ISP, on IPv6 or in a social app's in-app browser, you will lose real customers. A good filter is tuned to the source.
- No filter catches every bot. Advanced automation on residential addresses looks almost human. The goal is to filter out the bulk of junk without touching people, not to push filtering to the absolute.
- A White Page must be a real page. An empty page or a placeholder template makes a poor impression on everyone who lands on it, from a random visitor to a partner who decided to look at your site.
More on how automated traffic is detected in how to filter bot traffic.
Types of cloakers
Solutions differ in where the filtering logic runs:
| Type | How it works | Pros | Cons |
|---|---|---|---|
| Your own script | PHP code on your server with your own rules | Full control, no subscription fee | No up-to-date bot databases, you maintain everything yourself |
| Cloud service | A small snippet on your site, checks run on the service side | Fresh databases, shared experience across many flows, reports | You depend on the service, subscription |
| Free solutions | Public scripts and free-tier services | Costs nothing to start | Outdated databases, risk of leaking your funnels |
Your own script is fine while bots are few and primitive. Once automated browsers on proxies start hitting your links, maintaining databases and checks becomes a job of its own, and a cloud service usually turns out cheaper than your time.
How traffic filtering works in ArtisanClo
ArtisanClo is a cloud service for filtering and routing ad traffic with a built-in tracker. Your site stays with you: you add a JS tag as the first line in the landing page's <head>, or upload a PHP file to your hosting (for WordPress there is a plugin that sets up the same PHP method). Everything else runs on the service side.
The main building blocks:
- A Flow is one campaign: where to send people, whom to filter out and what to show those filtered out. Step by step in how to set up a cloaker.
- Check strictness — Soft, Balanced or Strict, with ready-made values for the traffic source: Facebook, Google, TikTok, native ads.
- A reason for every click: dozens of clear reasons such as "VPN or proxy blocked", "Outside campaign hours" or "Search or platform crawler".
- White Page — your own URL, a ready page from the design catalog built for your niche, or a bare response code.
- A shared bot list — an address confidently caught as a bot for one client immediately gets the White Page across every flow in the service.
- Tracker — clicks, leads, sales, cost, profit and ROI, postbacks from affiliate networks and sending conversions back to ad accounts.
The full feature list is on the ArtisanClo features page, plans are on the pricing page. You can try all of this on a free trial that shows the whole product.
Is cloaking legal?
Showing different content to different visitors is a common technique in itself: that is how geotargeting, A/B tests and bot protection work. However, ad platform policies explicitly prohibit showing reviewers something other than what users will see, and they ban accounts for it — up to every linked profile and payment method. Promoting prohibited products or deceiving people is no longer a matter of platform rules but of law.
So the sensible approach is:
- use filtering to weed out bots, scanners, spy tools and off-target traffic, to save budget and keep stats clean;
- advertise only what the platform allows, and build ads and landing pages according to its policies — the requirements are covered in Meta advertising policies and Google Ads policies;
- for gambling, finance, health and crypto, get the required licenses and platform authorization first — see restricted ad categories.
The advertiser is always responsible for the content of the ad.
Summary
- A cloaker is a filter between the ad and the site; cloaking is showing different pages to different visitors based on a check.
- Bots, scanners and spy tools see the White Page; real people see the offer.
- The filter looks at the network, address lists, browser, audience, ad click IDs and behavior.
- The value of a filter is saved budget, clean stats and funnels protected from copying — not getting around platform rules.
- A good cloaker explains every decision and is tuned to the source rather than cutting everyone indiscriminately.
The next step is learning how a bot is told apart from a human: see signs of bot traffic.
