URL cloaking explained: redirects, frames and the kind that gets banned

URL cloaking is any technique that shows a visitor a different address than the one that loads, and the phrase covers 3 practices with 3 verdicts.

A redirect from yourbrand.com/go/tool (21 characters) to a 76-character affiliate URL is what plugins such as Pretty Links sell, and each program sets its own rules for it. A registrar's frame masking fails on pages that refuse framing.

Showing Googlebot or an ad reviewer a different page than visitors get is what Google Search and Google Ads ban, and Google Ads suspends accounts for it without prior warning.

My rule is a plain redirect on a domain you own, the program's terms read first and a disclosure beside the link. Amazon Associates is where that matters most.

The three kinds of URL cloaking

Affiliate marketers mean row 1. Namecheap uses "URL cloaking" as another name for the frame feature in row 2. Google means row 3.

How a redirect cloak works

The visitor requests /go/tool, the server answers 302 with a Location header, and the browser loads that address. Nothing stays secret, since the destination travels in plain view to every client.

$ curl -sI https://yourbrand.com/go/tool
HTTP/2 302
location: https://partner.example/signup?aff_id=48213&sub=blogpost&utm_campaign=review

Use 302 or 307 for a cloak. A cached 301 or 308 can let a returning visitor's browser skip your server and keep going to the old destination after you edit it.

Pretty Links offers 301, 302 and 307 per link, and TrackRev sends a 302. The branded short link post covers how Google reads each code.

Why people cloak affiliate links

Editing in 1 place and shorter links are the strong reasons for affiliate link cloaking, and hiding the ID is the weak one. Pretty Links pitches the single edit on its WordPress.org listing and hijack protection on its cloaking page.

Frame-based URL masking and where it breaks

Namecheap defines URL Frame as a redirect type also called URL masking or URL cloaking: its server shows the target page inside a frame and the address bar keeps your domain.

It lists 2 drawbacks, duplicate content in search engines and sites that refuse masking.

A page that sends X-Frame-Options with the value DENY or SAMEORIGIN, or a CSP frame-ancestors directive that leaves out your domain, refuses to render inside your frame, and MDN says sites use these against clickjacking. I use a redirect instead.

Content cloaking under Google Search and Google Ads policy

Google Search lists moving a site, merging pages and redirecting logged-in users as legitimate redirects. Google Ads allows click trackers and redirects unless they hide something.

Device splits such as App Store versus Google Play show the same app to everyone, so I read them as outside the ban. That is my reading of the policy. Device-targeting redirects covers the setup.

What Amazon Associates and other programs allow

Whether a plain redirect on your own domain breaks any Amazon Associates clause is Amazon's call.

ThirstyAffiliates ships Smart Uncloaking for Amazon Associates compatibility, and its pricing page says it keeps Amazon links compliant with Amazon's terms while other programs stay cloaked.

Use the direct tagged links Amazon's tools generate, since the Operating Agreement (updated October 15, 2025) requires Special Links to use its tagged formats.

Of the affiliate programs, I checked only Amazon's wording, so search any other publisher agreement for cloak, mask and redirect.

Affiliate de-cloaking: how to see where a link goes

Affiliate de-cloaking can mean 2 things: switching a cloak off for a program that forbids it, as Smart Uncloaking does for Amazon Associates, and reading the destination behind a cloak.

A redirect cloak is a header, so any client can read it.

$ curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" https://yourbrand.com/go/tool
302 https://partner.example/signup?aff_id=48213&sub=blogpost&utm_campaign=review

The curl manual documents redirect_url, and curl -sIL prints every hop's headers instead. Google Chrome (Preserve log) and Mozilla Firefox (Persist Logs) show the chain on the Network tab.

A check may register as a click, so run it on your own links after each destination change and confirm the status is 302.

Disclosure and link attributes still apply

A cloak hides the affiliate parameters, so the disclosure carries the whole job.

16 CFR 255.5 requires an unexpected material connection to be disclosed clearly and conspicuously, and the FTC's guide for social media influencers says to place it with the endorsement, rather than burying it on a profile page or in a hashtag group.

See the affiliate compliance post for FTC and GDPR rules.

A cloaked link also looks like an internal link to a crawler until it follows the redirect, so mark it in your page.

Google's September 10, 2019 announcement added rel="sponsored" for links created as part of advertisements, sponsorships or other compensation agreements, and an affiliate commission fits that description.

Link cloaker tools compared

Pick a plugin when your whole site runs on WordPress and you earn from Amazon Associates and a few networks, since $99.60 a year costs less than Starter at $39 a month.

Pick a hosted tool when the redirect has to count revenue, or when partners other than you share the links.

Moving cloaked links off Pretty Links

• Step 1: export from Pretty Links at Dashboard, Pretty Links, Options, Tools, Export Links to CSV, which the free version (4.0.15 at the time of writing) includes. The file has 16 columns, including slug, url, redirect_type and clicks (Pretty Links CSV docs).
• Step 2: add a channel to each row. TrackRev's import needs a destination URL and a channel per row, keeps your slugs exactly, flags duplicate slugs before creating anything and takes 500 rows per upload.
• Step 3: point a CNAME for a subdomain such as go.yourbrand.com at cname.trackrev.io, verify it and import the CSV.
• Step 4: a subdomain cannot take over a path on your main domain, and published links point at yourbrand.com/go/slug. Leave the plugin active while they still get traffic, or add a server rule that redirects /go/* to the subdomain, and compare click counts for 7 days before removing it.
• Step 5: use the new links in new content and check each with the curl command above.

Cloaked links that count revenue in TrackRev

TrackRev serves links from a subdomain you own through 1 CNAME record and an automatic certificate, and the custom tracking domain page puts setup at about 5 minutes.

Each click hits a server-side redirect that logs country, device and referrer, flags bots and answers 302. Bulk link import handles the CSV above.

On paid plans from $39 a month, the click log joins Stripe, Paddle, Polar and Lemon Squeezy payments, and link tracking shows the revenue each link earned.

The free plan has 50 links and 1,000 tracked events a month and hides revenue. Partner links in an affiliate program, a paid-plan feature, use your branded domain by default.

TrackRev's acceptable-use terms bar cloaking a destination with intent to deceive. Plans and limits are on the pricing page.