Learn · Technical SEO · Beginner
Learn what Google counts as hidden links and cloaking, and how to use your browser and Search Console to look for links on your pages that you never added.
By Dean Cruddace · 45 minutes to do · Updated · Last reviewed
A hidden link is a link visitors cannot easily see, such as one in white text on a white background. An injected link is one someone else put on your site without permission. Cloaking means showing search engines different content from what people see.
Google says hidden text or links are a problem when placed solely to manipulate search engines and not to be easily viewable by people. Tabs, accordions, sliders, tooltips and screen-reader text do not break the policy.
Google says hackers can add hidden links or text to your pages, or use cloaking to make a hack harder for you to spot, so a page that looks clean in your browser is not proof it is clean. Pages that break its spam policies may rank lower or not appear at all. See Google's spam policies and the Manual actions report help.
Read the hidden text, cloaking and hacked content sections of Google's spam policies. Hidden text or link examples include white text on a white background, text positioned off-screen with CSS, a font size or opacity of 0, and a link on a single small character such as a hyphen.
You will know it worked when You can name three ways a link might be hidden and three design features Google says are acceptable.
Open a page you want to check. Select all the text with Ctrl+A (Command+A on a Mac). Google's manual action help suggests this as a way to reveal text that is the same colour as the background. Look for blocks of text or links you do not recognise.
You will know it worked when You have either spotted text you did not expect or confirmed that nothing unfamiliar is revealed.
Right-click the page, choose View page source, and press Ctrl+F. Search for href= and step through the results looking for addresses you do not recognise. Google advises searching your pages and source files for links you did not add. If you suspect a hack, use the next step instead of opening pages directly, as Google warns that can be risky.
You will know it worked when You have a list of every outbound address on the page and you recognise each one, or you have marked the ones you do not.
Paste the page address into the inspection bar at the top of Search Console and open View crawled page to see the raw HTML Google received. Compare it with step 3. Google says hackers often make changes visible only to Google, such as links shown only when the visitor arrives from Google. See URL Inspection help and the Security issues report help.
You will know it worked when You have compared the two versions and noted any link that is in Google's copy but not in the one you viewed.
In Google, search site: followed by your site's root address, with no space (for example site:example.com). Google's web.dev guidance recommends this to show pages on your site, including any a hacker might have added.
You will know it worked when You have scrolled the results and recognise every page, or you have noted the ones you do not.
Open Security issues and Manual actions in Search Console. Google calls the Security issues report the source of truth. Its example URLs are only a sample, and an issue with no examples does not mean no pages are affected.
You will know it worked when Both reports are open and you have read what they say, including a message that no issues are detected.
For injected content, Google says to restore affected files from your last good backup or remove the spammy links from each page, then request a review in the relevant report. For hidden text on your own pages, remove or restyle it so it is equally visible to crawlers and people. For a confirmed hack, Google suggests building a support team, so consider a security professional.
You will know it worked when The links are gone from the page source, and the report you used shows the review as requested or resolved.
Go deeper
Send Dean a page address and what View page source shows. Rendering and crawling checks are part of technical SEO.
