Link cloaking: hiding a destination, and where it crosses

Link cloaking is concealing a link's true destination from the person or system following it. The word covers two very different practices, and the difference is who is being kept in the dark.

The ordinary version

Affiliate links are long, ugly and carry a partner ID. Wrapping one in gc.mw/gear is called cloaking in affiliate-marketing writing, and it is unremarkable: the destination is still discoverable by anyone who looks, and the disclosure obligation lives in the text next to the link, not in the URL. Frame-based cloaking — loading the destination inside an iframe so the address bar keeps showing your domain — is worse, because it breaks the back button, breaks sharing and blocks the browser's own safety warnings. gc.mw does not do it: every redirect is a real HTTP redirect and the address bar shows the destination.

The version that is banned

Serving one destination to a search crawler, a security scanner or a platform's review system and another to a human. This is how a phishing page survives review: the reviewer sees a harmless landing page, the victim sees the credential form. Chaining through several shorteners to make the final destination hard to trace is the same tactic with more steps.

Our acceptable-use policy names both, and the safety pipeline is built against them. Destinations are followed up to three hops when a link is created and every hop is checked, so a clean first URL that lands somewhere dirty fails the check rather than passing it.

Why transparency is the design

Every gc.mw link has a public preview: gc.mw/abcd+ shows the destination host without following the link, and it is noindex so it cannot be gamed. The blocked-link page says a link was disabled rather than quietly returning a 404. A shortener that cannot be inspected is a shortener that gets its domain blocklisted, which ends every customer's links at once.

Example

gc.mw/gear sent to a newsletter, disclosed as an affiliate link in the sentence next to it, resolving for everyone to the same product page: fine. The same code answering differently depending on whether the user agent looks like a scanner: reported, blocked, and grounds for closing the account.

Check any link you were sent with the link expander.