Affiliate Link De-Cloaking: What People Can See

Click a cloaked affiliate link and watch the address bar. For a moment it says yoursite.com/go/kitchen-scale. Then it changes to the merchant’s address, affiliate ID and all.

That small moment is the whole story of affiliate link de-cloaking. Cloaking is a tidy label on a door. It was never a lock.

What cloaking hides, and when

A cloaked link is a redirect. Your server receives a request for the short URL, looks up the destination you saved, and answers with an instruction: go here instead. The browser follows the instruction and shows you where it ended up.

So the two moments look different.

Before the click, a reader hovering over the link sees only your short address. The long URL with its tracking parameters stays out of sight, which is the part people like.

After the click, the reader is on the merchant’s site, and the address bar shows the real destination, parameters included. Nothing in a standard redirect can change that.

WB Ad Manager works this way. It sends a normal HTTP redirect, 307 by default, with 301 and 302 selectable per link. It is the same kind of redirect every cloaking tool uses.

The redirect, step by step

It helps to see the sequence once, because every other point in this post follows from it.

1. A reader clicks a link such as yoursite.com/go/kitchen-scale.
2. WordPress receives the request and the plugin looks up the slug.
3. If the link is switched off or past its expiry date, the plugin handles it as an inactive link. By default that is a 404. A setting can send visitors to your home page or to a fallback URL instead.
4. If the link is active, the plugin adds one to its click count.
5. The plugin answers with a redirect to the destination URL, parameters added.
6. The browser follows the redirect and loads the merchant’s page.

Step 5 is the one that matters here. The destination travels in a response header that your server sends to whoever asked. A visitor, a browser, a script and a crawler all get the same answer.

How people de-cloak a link

Searches for “de-cloaking” can mean a few different things. One is plain curiosity: where does this short link really go?

Every one of these requests reaches your server.

None of these is clever. Any tool that asks your server where the short link points will be told.

One consequence is worth knowing. The click counter in WB Ad Manager 3.1.1 does not filter bots or repeat visits, so anything that requests the short link can add to the count. Treat the number as real clicks plus some noise, and compare links against each other rather than trusting one absolute total.

Status codes in plain words

The status code tells the requester what kind of move this is. You choose one per link, and the choice is about how the web treats the move, not about hiding anything.

• 307, temporary. The default. The destination may change, so browsers and search engines are asked not to treat the move as permanent.
• 302, temporary. The older temporary code. It behaves much like 307 for a reader.
• 301, permanent. It says the short link has moved for good. Use it when the destination really will not change.

Affiliate destinations change often, because merchants rename pages and swap programs. A temporary code matches that reality, which is why 307 is the default. Whichever you choose, the code is visible to anyone who looks at the response.

Check your own links the way a stranger would

It takes a minute and it shows you exactly what a reader sees. Pick one cloaked link on your site.

1. Open the page in a browser and hover over the link. Read the address in the status bar. That is the short URL.
2. Open the browser’s developer tools and switch to the Network tab. Tick Preserve log, so the record survives the redirect.
3. Click the link. Look for the first request, the one to your /go/ address. Its status will be 307, 302 or 301, whichever you set on the link.
4. Open that request and find the Location header. That is the destination the visitor is sent to, and anyone who looks can read it.

From a terminal, curl -I https://yoursite.com/go/your-slug prints the same headers, and the Location line is the one to read.

Two things are worth checking while you are there. The status code should be a temporary one, which is the default. And the destination should be the offer you meant. A link that lands on a retired product page is the usual way a cloaked link goes quietly stale.

What bots and crawlers do

Crawlers request the short URL like anyone else and follow the redirect. A search engine that finds your /go/ link reads the status code and the destination, and it reads the rel attributes on the link in your page.

That is why the two checkboxes on each link matter more than the cloak itself. Nofollow is ticked for new links. Sponsored is not, so tick it on every affiliate link. Those attributes tell a search engine the relationship in a way the short URL cannot.

The plugin does not tell human clicks from automated ones. Its click count rises for any request to the short link, as described above, so uptime monitors, link checkers and crawlers can all add to it.

Tools that strip or swap parameters

Some privacy extensions and browsers remove known tracking parameters from URLs. Whether a given tool leaves an affiliate ID alone depends on the tool, and you have no say in it.

That is a reason to treat cloaking as housekeeping and not as protection for your commissions. If a reader’s browser rewrites the destination after the redirect, the cloak is long gone by then.

A note on the plugin’s own help text

The link editor in the plugin carries a short description beside the Enable cloaking option. It suggests that the short URL stays in the address bar while the visitor is sent to the destination. That is not what happens. The plugin sends a standard redirect, and the browser ends up on the destination with its own address showing.

We mention it because the wording can leave a site owner expecting more privacy than a redirect gives. Treat cloaking as a way to keep links tidy and in one place, and the plugin behaves exactly as you expect.

When de-cloaking means taking your own links apart

The other meaning is practical. You have a site full of /go/ links and you want them gone, maybe because you are changing plugins.

The short links are served by the plugin, so if you deactivate it they stop resolving. Replace them first.

For a handful of links, open Links > All Links, copy each Destination URL and swap it into the post. For one link at a time, you can also switch off Enable cloaking on the link itself. With that off, the raw destination goes into your content through the shortcode instead.

Do this before you remove anything. A dead /go/ link sends the reader to a 404 and earns nothing.

Myths worth dropping

A few ideas about cloaking circulate widely, and none holds up.

• “Cloaking stops commission theft.” Anyone can still read the destination after the click and copy it. Cloaking does not lock the parameters.
• “Readers will never know it is an affiliate link.” Anyone who hovers, clicks or inspects the response can tell. Disclosure is still your job.
• “A cloaked link is invisible to search engines.” Crawlers follow the redirect and read the rel attributes on your page.
• “Cloaking makes the link safer.” It changes the address on your page and nothing else about the link.

What it gives you is control: one place to edit a destination, a link you can read aloud and a click total.

Setting up a link you will not regret

Because the short link is readable by anyone, it pays to name links with care. Each link has a private name that only appears in your admin list, so use something you will recognise in a year, such as the merchant and the product. The slug is the public part, and it appears in your content and in the address a reader sees on hover.

A few habits keep a link library tidy:

• Short, plain slugs. kitchen-scale beats amzn-b09x7z-tag21. A slug that reads well also looks honest.
• A link type. The free plugin offers types such as affiliate, paid link, link exchange and sponsored post. The type labels the link in the list so you can filter by it. It does not change how the redirect works.
• A category. Group links by merchant or topic, then print a whole category with the links shortcode.
• One prefix for the site. The word before the slug defaults to go, and you can change it once in the settings. Changing it later breaks short links you have already published, so choose it early.

Set the expiry date on seasonal offers when you create them, not when they have already lapsed.

What cloaking is actually good for

Cloaking earns its place for dull, useful reasons:

• One place to change a destination. When a merchant restructures a URL, you edit one entry and every post that uses the link follows. We cover that in switching to tracked, branded links.
• Readable links. /go/kindle-paperwhite is easier to read and remember than a 200-character URL.
• A click total per link. The free plugin keeps a running count in the Links list. Referrer, country and device breakdowns are Pro.
• The rel attributes, set deliberately. Each link has a checkbox for nofollow and one for sponsored. New links come with nofollow ticked and sponsored not, so tick sponsored on every affiliate link.

Secrecy is not on the list. If a plan depends on the reader never learning the destination, it will not work, and it is easy to build a post that does not need it: say plainly that the link is an affiliate link, and let the short URL do its housekeeping.

Finding raw links on your own site

If you have a large archive, you may not know which posts still hold raw, uncloaked affiliate URLs. The Pro plugin has a link scanner that finds affiliate URLs already sitting in your content so you can cloak them, a keyword auto-linker that turns a chosen phrase into a cloaked link everywhere it appears, and a broken-link checker that flags cloaked links whose destination has stopped working. The free plugin does not include these, so on free the audit is a manual read of your most-read posts.

Pro also brings in links from a CSV file, for example one exported from ThirstyAffiliates or Pretty Links. The file needs a header row with name and destination_url, and a slug column keeps each short link. There is no column-mapping screen, so rename the headers to match the sample file.

The free versus Pro page lists the full split.

A short check before you publish a cloaked link

Run through this once for every new link. It takes under a minute and saves a stale or mislabelled link.

1. Click Test Link in the editor and confirm the destination is the page you meant.
2. Confirm the redirect type is the one you want, and that sponsored is ticked.
3. Check the expiry date, if the offer is seasonal.
4. Put a plain disclosure near the link in the post.
5. Revisit the link whenever a merchant changes its program.

Disclose the link whether or not it is cloaked

A short URL does not change what a link is. The FTC says an affiliate marketer should disclose the relationship clearly and conspicuously on the site, so readers can decide how much weight to give the recommendation. A cloaked link carries the same obligation as a raw one.

We cover wording and placement in affiliate link disclosure: where it goes and what to say. For the basics of how cloaking works and where it sits against search engine rules, start with what is link cloaking.

If you want to try it, link cloaking in WB Ad Manager is free, and the affiliate use case walks through the setup.