Detect cloaking. Each page is fetched as a real browser, as Googlebot, and as the Google AMP cache — external links, scripts and iframes served to a bot but withheld from browsers are reported. Regular scans, which fetch pages as a browser, never see them.

Scan a site

What cloakscan checks
FindingMeaning
ua-cloakingGooglebot receives external references a browser does not.
amp-cloaked-injectionThe Google AMP cache fetch receives content a browser does not.
disallowed-script-in-ampAMP page loads scripts from outside cdn.ampproject.org.
inline-script-in-ampExecutable inline JS in an AMP document (invalid AMP).
meta-refresh-in-ampAMP variant meta-refreshes visitors to an external site.
amp-only-external-linkExternal links present only in the AMP variant.
amp-only-iframe / -form / -scriptExternal iframe, form or script present only in the AMP variant.
hidden-amp-endpointAn AMP document served at a URL the page never declares.