The redirect that only existed for Google

The redirect that only existed for Google

A media publisher got a manual action for cloaking. They'd never cloaked anything on purpose — and that's exactly why it took three weeks to find.

The data: Googlebot was being served a different page than users on roughly 8% of URLs. The team checked their code. No user-agent branching anywhere.

The reveal came from a geolocation layer. The app did client-side geo-redirects: detect country in JavaScript, route EU users to /eu/, etc. But for bots, which present no reliable geo and ran the JS in a US data center, the logic dumped them onto a fallback 'choose your region' interstitial — while logged-in human users sailed past it. Google rendered the interstitial, users saw content. Accidental cloaking, born from good intentions.

Turns out any 'decide what to show after JS runs' branch can diverge bot and user experience without anyone writing if (isGooglebot).

The fix: move region detection server-side off the request, serve the same canonical content to everyone, and make region a navigational choice, not a gate.

Result: manual action lifted in 18 days after reconsideration, organic recovered from -52% to baseline in 10 weeks.