Cloaking for Facebook Ads in 2024— A Step-by-Step Guide

Facebook is rightfully considered as one of the best traffic sources (just think for a second — 2.8 billion users) that provide the best targeting options for marketing. Those who are in the affiliate marketing industry for a while know well how efficient this platform is in the promotion of affiliate offers. However, the downside for us, marketers, is that Facebook is well known for its strict policy towards advertising. As a result, in the pursuit of income marketers look for techniques that allow avoiding or deceiving Facebook restrictions. One of such techniques is called cloaking.

Actually, cloaking of any kind is a method to differentiate the sites for Facebook ad moderation and real traffic. No doubt, Facebook is one of the best platforms for advertisers due to the excellent demographic targeting. But due to strong restrictions for ads, the list of products and services that aren’t allowed to be advertised on the platform is quite long. For example, you can’t advertise tobacco (and tobacco-related) products, weapons and ammunition, drugs (and related) products, adult products and adult-related content, many types of supplements, alcohol, gambling, short-term loans, etc.

So, many companies and marketers are left out in the cold and can’t benefit from a huge audience and great targeting options. So, some of them found a way to avoid bans and get access to the Facebook audience. Despite tough measures applied by Facebook, a lot of marketers still choose to risk.

How marketers identify Facebook moderation? Sure, Facebook doesn’t make public announcements on the list of IPs associated with its moderation system. However, some information is leaked. So, when a server identifies the request from one of the IPs associated with Facebook verification, it shows the page that is fully compliant with Facebook’s policy and requirements. Naturally, if requests come from other IPs (that are not listed as Facebook verification), servers show the true content.

But first things first. Some of you have already been implementing cloaking for various platforms, but marketing tyros might be just wondering what this technique is.

In fact, there are two key meanings of "cloaking" in affiliate marketing. In both cases ‘to cloak’ means to disguise or hide. The first case is related to the most common form of cloaking — link shortening. If you’re in digital marketing for a while, you should know how long and ugly some affiliate links are. So, marketers “beautify” links by making them shorter (or prettier). Actually, when you read articles about cloaking, they will be focused on different kinds of link shortening. There are several reasons to implement link shortening. First of all, to create shorter, memorable URLs which are much easier to use and share. Second, short links protect you from commission hijacking because pretty links hide your affiliate ID.

The second meaning of cloaking is target URL masking. In this case, marketers intend to hide the target URL from some visitors (moderators and verifiers). This method is implemented to avoid restrictions applied by some platforms. So, cloaking is a popular method to outwit Facebook’s reviewing procedures to demonstrate content that doesn’t fully comply with the platform’s policy and standards. The mechanism includes hiding the final destination (a landing page designed for users or a post).  In other words, ‘cloaking’ is a trick used by marketers to avoid existing bans on some popular platforms to show search engines and content moderators a legitimate and benign variant of the site while users see another version with promoted content.

Three Types of Cloaking

Given the above, cloaking can be divided into three types based on the meaning and the implementation.  

White Hat Cloaking

This method means the separation of all users into various groups based on their interests and location. Search engines implement this technique to redirect users to localized platforms. Likewise, many online marketplaces offer services and products following the user’s search history. Filtering fraud traffic (VPN servers, irrelevant GEOs, spy bots, etc.) that eats up your ad budget is still considered white hat. The key principle is that both regular users and verifiers/moderators see the same page and the same content.

Grey Hat Cloaking

This type of cloaking doesn’t deal with formally prohibited or illegal content but goes against some individual services policy. Grey hat is often used for SEO: search engine bots see a web page full of keywords, while an ordinary article is displayed to users. Technically, it isn’t illegal. But many search engines consider such pages as fraud and ban accounts.

Black Hat Cloaking

As you should have guessed already, black hat cloaking includes the promotion of prohibited content or niches. Not always it should be illegal products or services, in most cases, marketers deal with verticals that might represent some degree of risk, such as gambling, betting, crypto, adult, dating, or dubious food supplements. Black hat cloaking is used to deceive moderators/verifiers, users, and affiliate programs (in case you hide the traffic source — some affiliate programs do not accept specific types of traffic, for example, adult traffic).

Experienced marketers recommend "bleach" grey- and black-hat offers. Bleaching means making blackhat creatives more similar to white-hat bundles. If you succeed to pass moderation, you can still be banned based on user complaints. Keep in mind, cloaking helps to pass official moderation only.

It is an open secret that Facebook isn’t always friendly to affiliate ads. Marketers can wake up one morning and discover that the page was closed, or the account is banned. Raw affiliate links aren’t welcome too.  

Marketers are pretty aware that the most profitable niches are gambling, dating, and crypto. By promoting offers in these categories you can get fantastic ROI and high commissions in a short time. The only thing you need is targeted traffic. Well, Facebook with its billions of users is the perfect source of traffic. However, the platform has a very strict policy towards ads, including restrictions for gambling, crypto, and dating ads. Ok, you can look for other traffic sources or go with blackhat techniques to avoid restrictions and benefit from Facebook traffic.

Why Use Cloaking in Affiliate Marketing

• Cloaking is used mainly to deceive moderation and promote prohibited content. For instance, gambling isn’t welcome on Facebook. However, there are millions of potential gamblers among Facebook users. Hence, marketers implement cloaking to promote gambling offers: moderators and verifiers see a white page that complies with the Facebook ad policy, while regular users see gambling ads.

• Cloaking helps to get rid of unwanted traffic, including users using VPN, competitors, or search bots. You don’t want to waste your ad budget on this type of traffic. Cloaking helps you to protect the content from being stolen as users cannot see the source code. Besides, you protect yourself from spy services, because you create a database that includes not only search bots and verifiers but spy robots (that collect fake pages) too.  

Cloaking: How It Works

Cloaking implies special scripts run by a web server. When a server receives a request, it identifies whether the request comes from a user or a verifier (moderator or robot). If a script determines a moderator (robot), it will display a White Page (compliant with the platform’s policy) to pass moderation. Regular users will be directed to the Offer Page.

There are two principal methods to determine who clicked on your link:

• By IP address. In this case, the server identifies bots and moderators by IP addresses. There is a blacklist of IP addresses related to verifiers or unwanted traffic. If the IP address is blacklisted, so the White Page will be shown. Otherwise, the offer page is displayed.
• By user-agent value. A database with a blacklist for filtering is attached to the script on the web server. If a user name is blacklisted, so the White Page will be displayed. All other users will see the real offer page. This is an effective method that is easy to set up. Unfortunately, bots are changing their names now to deceive cloaking. Recently, moderators began disguising themselves as regular users to discover fraud.  

The IP identification is considered more efficient because even if a bot/moderator changes its name, the server determines it by the IP address.

Actually, it sounds more complicated than it is in reality. As of now, marketers don’t need to launch their own servers, write and configure scripts, search for databases of moderators and bots. There are many specialized services to perform all these tasks. Some services provide double identification: IP address + User agent. Paid services include additional methods of identification and continuous update of IP and User agent databases.

Facebook Cloaking: Step-by-Step

Generally, Facebook cloaking includes three basic stages: farming, page setup, and warm-up. The key principle is "Take your time!" You should be ready to wait till your new page will mature or to pay some extra for existing accounts. Let’s see the process in more detail.

1. Farming

You can create new Facebook accounts (optionally, buy or rent accounts) and emulate real activity. On average, the success rate is somewhere around 60-70%.

You should pay close attention while selecting the right IP solution — it must be residential IP (do not consider proxy and VPN solutions — it won’t work out); the IP location should go with ZIP of credit cards. You can rent real people’s Facebook accounts — you need high-quality, aged, and filled accounts; this way the success rate might approach 98-100%.

2. Page Setup

Next, you pick (or create) a local business or community page with a high-quality score. Maintain the page’s level — upload at least 5-7 posts. In case you pick a farmed account, consider inviting friends to like the page.

3. Warm-Up

Then you continue working on the page’s quality score. For that, you need to run ads with high engagement; hence, focus mainly on the quality of your ads. You’ll need to run at least three campaigns. The first campaign you launch from the Page and it’s focused on gaining likes. You need to enter a card there. Important: card numbers must be typed (do not use ‘copy-paste’). Prepared accounts should stay untouched for not less than 24 hours. Next, start Business Manager, add your personal account, and add around 3-4 additional accounts. Why? In case your account gets banned you will have a chance to use other accounts.

The second campaign is targeted at engagement. You need a higher quality score, so you need to ensure more engagement on the post. Create a desktop-only campaign without any links in the promoted post.

Next, the third campaign is usually called a ‘website clicks campaign’. You launch this campaign when the billing is around $500. The URL, text, and image for this campaign should be the same as for the blackhat campaign. Run the $30-40 safe page warm-up. The warm-up might take from 4 days to two weeks.  Don’t hurry and randomize your budgets.

Best Cloaking Services

Some cloaking vendors are public and well-known, such as LeadCloak, Linkscloaking, Cloakerly, or TrafficArmor. As you may know by now, one of the most popular cloaking services, LeadCloak, is in direct legal confrontation with Facebook.

Cloakerly. This is one of the most popular services in affiliate marketing. The platform offers its services through several packages, starting from $149.

Cloak It. A cloud cloaking service suitable for Facebook and Instagram, Google, and WebView. No need to install and configure anything — the admin panel is located on the company’s server. You just register and start using the service. The cloaking is an instant process — there is no delay in processing requests. Requests are filtered by various parameters, including user agent, IP addresses, and crawlers. Monthly subscription plans begin from $60 per single campaign. The company offers a 50% discount for the yearly subscription.

IM KLO. This is a cloaking service suitable for Facebook and not applicable to other platforms. IM KLO provides an open-source code, a continuously updated database of IP addresses for search bots and unwanted users, as well as a wide array of filters and tracker integration. IM KLO stands out among other services (which are mostly cloud-based) because the script should be installed on your server (uploaded to the domain root) to get access to all features. There is no monthly subscription; you just purchase the installation files once ($330 per lifetime use; sometimes you can catch discounts up to 30%).  

BHOLE.SPACE. This is an inexpensive cloaking service (only $25 a month) that is easy to implement on Facebook. A monthly subscription allows up to 10 domains and 25 campaigns.  The service is capable of working with various traffic sources but provides the most expanded database of user agents and IPs for social networks.

Keitaro. This is one of the most popular multifunctional services targeted at marketing professionals. The service provides a vast array of services to manage traffic, including cloaking services. The platform’s functionality includes numerous options for redirects (HTTP, meta-redirect, iframe, and JS), a one-click traffic flow rotation, over 30 filters for traffic redirection, a complete API, a built-in editor for landing pages, automatic reporting tool, integration with various traffic sources. The cloaking service has a database of more than 500k IPs. A multi-user mode is available. Keitaro requires uploading the script to a server (not a cloud service). Monthly plans start from $25 (one user, one domain). A free 7-day trial is available.  

HideClick. One of the most powerful platforms for filtering traffic that has been specifically designed for large companies. The service offers a wide range of features, including protection against spy services and block transitions from proxies. HideClick offers a huge database of IP bots for Facebook, Google, and some other platforms. The service can be integrated with WordPress, Keitaro, Cloudflare, Apache, and Nginx. The system should be installed on a server through a 3-step setup. The standard plan costs $145, advanced and professional plans are $245 and $1 495, respectively. Pro-subscription includes multi-user mode, JS-integration, SDK for iOS and Android, blocking of spy services, and proxies. A 7-day free trial is available for all plans.

Zeustrak. This is one more cloud-based cloaking service that runs with all ad exchanges. The service provides a huge (and regularly updated) database of IP addresses for moderators, search engine bots, and unwanted users. Users can add their own URLs for additional filtering. The analytical tool provides real-time data on clicks, bids, CTR, and estimated profit. One of the most useful features is a multi-user mode that allows several marketing specialists to work from a single profile. The service offers a 7-day free trial. Plans start from 249 euros (10 domains, 5 servers) with a discount of up to 30% for buying a yearly plan. The service is compatible with Facebook Ads and Google Ads.  

Traffic Armor. A well-known platform for filtering traffic by a user agent and IP addresses. The platform provides an extensive database of bots, spyware, proxy servers, and VPNs. Users can add their own unwanted IPs to the database. The cloaking service is compatible with all major ad networks. Plans depend on the number of clicks: Basic plan is $129 for 32 500 clicks per month.

NoIpFraud. An exclusive popular service for filtering unwanted traffic. Unfortunately, there are no plans or pricing published, so you can get access to the service only through direct negotiations with the tech support. All plans are developed individually. There is no free trial.

Fairlab. You might have heard about FairLab as one of the most expensive cloaking services. However, the system is very effective in filtering traffic. You can add links to creatives, choose required filters, and click 'Launch — this is simple. The service has its own network capable of analyzing 25 parameters for every device; the service can identify bots and moderators even when their IPs are changed or VPN is implemented. According to the developers, they strive to be always a step ahead of all other players in the market. The service is designed for Facebook Ads and Google Ads, but can be used successfully for other networks, such as Pinterest, Twitter, MyTarget, etc. There are daily, monthly, and yearly plans with flexible pricing models. For example, daily plans include Light for $19.99 and Prime for $39.99. New customers can check the functionality with a 7-day free trial.

LinkTrackr. A universal multifunctional service designed for marketing automation. This is one of the most popular and inexpensive services with numerous tools, such as link cloaking, ad tracking, PPC tracking, pixel tracking, subID tracking, URL rotator, etc. Marketers can use an unlimited number of domains and efficiently disguise affiliate links for Facebook. The good thing is that the service is suitable for both beginners and professionals. Plans start from $17; a discount of 10-20% is available for buying a yearly subscription.  

FraudFilter.io. The service blocks unwanted traffic evaluating visitors by multiple parameters. The platform has an impressive database that is continuously updated. The service costs 162 euros per month. The cloaking service is compatible with 130 ad networks and most CMS platforms, including WordPress, Joomla, Shopify, Drupal, Weebly, etc.  

If you are confused and can’t choose the right cloaking service give a look at some reviews from fellow marketers at BlackHatWorld forum’s thread dedicated to Fb cloaking. 

Facebook Cloaking: an Example

Imagine, you have a company specialized in food supplements (manufacturer or dealer). You can’t run a Facebook ad campaign as your ads would be blocked (or have been blocked). So, you’ve decided to go with cloaking. Now, let’s see what steps you take to let your ads work.

You create a new account and a new page. Then, run several Facebook ad campaigns to get page likes and reviews (yep, probably you’ll buy them). Your page and ads will definitely be inspected, but it is fine as your page is spotless.

Then, you have to identify the IP addresses of Facebook verifiers and continuously update them. Some companies provide this service, so you can check reviews of your fellow marketers to select a reliable company. To tell the truth, cloaking services sometimes are more cost-effective than the tiresome process of implementing the system yourself.

When everything is ready, you do not turn it on right away. Run the campaign with the "right" page for a while, later switch to your IP-filtering system so that users see the page with food supplements promotion and Facebook verifiers see the smoothed-out version. The chance to be caught is pretty high; this explains the very aggressive advertising style implemented by many marketers.

What parameters make Facebook moderators suspicious towards ads:

• Domain Whois privacy protection
• Recent Facebook accounts with high spend
• Link URL structure
• Marketing pack (tracking, analytics, etc.)
• No Facebook Pixel (or using it via iframes and piggyback)
• Numerous other metrics.

Facebook & Cloaking: Official Response

In 2017, Rob Leathern, Product Management Director, and Bobbie Chang, Software Engineer, gave an extended comment on Facebook’s policy towards cloaking techniques. In brief, they stressed that Facebook has been continuously combating any kind of misleading ads. Additionally, the Facebook administration considers "cloaking" as a violation of Facebook’s Community Standards and Advertising Policies.

The platform applies the most advanced technologies, including AI, to reveal and ban ads that contain ‘cloaked’ destination pages: "we are utilizing artificial intelligence and have expanded our human review processes to help us identify, capture, and verify cloaking. We can now better observe differences in the type of content served to people using our apps compared to our own internal systems… We see cloaking as deliberate and deceptive, and will not tolerate it on Facebook. We will remove Pages that engage in cloaking. Otherwise, Pages should not see changes to their referral traffic."  

Facebook has strengthened the policy to explicitly call out 'cloaking'. Advertisers and Pages that implement ‘cloaking’ for their ads are banned from the platform.

On April 20, 2020, Facebook filed a lawsuit against LeadCloak for the company's 'cloaking' software to redirect Facebook users. Facebook accuses LeadCloak of using the software for concealing scam websites related to fake news, COVID-19, diet pills, and cryptocurrency.

There Is Always a Way Out

The situation sounds complicated. No one wants to get banned and everyone wants to earn on lucrative affiliate programs. When old schemes don’t work anymore you can always ask your counterparts for a piece of advice.

If you are not a member of marketing communities, it is high time to join and benefit from industry-focused discussions. Warrior Forum, BlackHatWorld, and AffiliateFix are among the most popular and helpful platforms from marketers. You can discover your own favorite community to share experiences, ask questions, and learn about new trends and updates in the marketing world.

Conclusion

Cloaking is not a new technique. Over the years, it has developed into a very sophisticated and intricate strategy. You probably know that in the very beginning cloaking was used for tricking search engines and covering sites full of malware or inappropriate content. Later, the reach of cloaking was significantly expanded to cover social media too. Despite many risks associated with cloaking, many marketers still rely on it to promote affiliate offers.

Obviously, cloaking becomes more and more complicated and difficult to detect. The same as Facebook implements more advanced and sophisticated technologies (for example, AI) to reveal cloaking, cloakers use innovative tools to bypass detection mechanisms.