Click a cloaked affiliate link and watch the address bar. For a moment it says yoursite.com/go/kitchen-scale. Then it changes to the merchant’s address, affiliate ID and all.
That small moment is the whole story of affiliate link de-cloaking. Cloaking is a tidy label on a door. It was never a lock.
What cloaking hides, and when
A cloaked link is a redirect. Your server receives a request for the short URL, looks up the destination you saved, and answers with an instruction: go here instead. The browser follows the instruction and shows you where it ended up.
So the two moments look different.
Before the click, a reader hovering over the link sees only your short address. The long URL with its tracking parameters stays out of sight, which is the part people like.
After the click, the reader is on the merchant’s site, and the address bar shows the real destination, parameters included. Nothing in a standard redirect can change that.
WB Ad Manager works this way. It sends a normal HTTP redirect, 307 by default, with 301 and 302 selectable per link. It is the same kind of redirect every cloaking tool uses.
How people de-cloak a link
Searches for “de-cloaking” can mean a few different things. One is plain curiosity: where does this short link really go?
| Method | What it shows |
|---|---|
| Click it and read the address bar | The destination, with parameters |
| Browser developer tools, Network tab | The redirect, its status code and the destination |
curl -I yoursite.com/go/slug | The Location header with the destination |
| Online redirect checkers and link expanders | The full chain of redirects |
Every one of these requests reaches your server.
None of these is clever. Any tool that asks your server where the short link points will be told.
One consequence is worth knowing. The click counter in WB Ad Manager 3.1.1 does not filter bots or repeat visits, so anything that requests the short link can add to the count. Treat the number as real clicks plus some noise, and compare links against each other rather than trusting one absolute total.
Check your own links the way a stranger would
It takes a minute and it shows you exactly what a reader sees. Pick one cloaked link on your site.
- Open the page in a browser and hover over the link. Read the address in the status bar. That is the short URL.
- Open the browser’s developer tools and switch to the Network tab. Tick Preserve log, so the record survives the redirect.
- Click the link. Look for the first request, the one to your
/go/address. Its status will be 307, 302 or 301, whichever you set on the link. - Open that request and find the
Locationheader. That is the destination the visitor is sent to, and anyone who looks can read it.
From a terminal, curl -I https://yoursite.com/go/your-slug prints the same headers, and the Location line is the one to read.
Two things are worth checking while you are there. The status code should be a temporary one, which is the default. And the destination should be the offer you meant. A link that lands on a retired product page is the usual way a cloaked link goes quietly stale.
Tools that strip or swap parameters
Some privacy extensions and browsers remove known tracking parameters from URLs. Whether a given tool leaves an affiliate ID alone depends on the tool, and you have no say in it.
That is a reason to treat cloaking as housekeeping and not as protection for your commissions. If a reader’s browser rewrites the destination after the redirect, the cloak is long gone by then.
When de-cloaking means taking your own links apart
The other meaning is practical. You have a site full of /go/ links and you want them gone, maybe because you are changing plugins.
The short links are served by the plugin, so if you deactivate it they stop resolving. Replace them first.
For a handful of links, open Links > All Links, copy each Destination URL and swap it into the post. For one link at a time, you can also switch off Enable cloaking on the link itself. With that off, the raw destination goes into your content through the shortcode instead.
Do this before you remove anything. A dead /go/ link sends the reader to a 404 and earns nothing.
What cloaking is actually good for
Cloaking earns its place for dull, useful reasons:
- One place to change a destination. When a merchant restructures a URL, you edit one entry and every post that uses the link follows. We cover that in switching to tracked, branded links.
- Readable links.
/go/kindle-paperwhiteis easier to read and remember than a 200-character URL. - A click total per link. The free plugin keeps a running count in the Links list. Referrer, country and device breakdowns are Pro.
- The
relattributes, set deliberately. Each link has a checkbox fornofollowand one forsponsored. New links come with nofollow ticked and sponsored not, so tick sponsored on every affiliate link.
Secrecy is not on the list. If a plan depends on the reader never learning the destination, it will not work, and it is easy to build a post that does not need it: say plainly that the link is an affiliate link, and let the short URL do its housekeeping.
Disclose the link whether or not it is cloaked
A short URL does not change what a link is. The FTC says an affiliate marketer should disclose the relationship clearly and conspicuously on the site, so readers can decide how much weight to give the recommendation. A cloaked link carries the same obligation as a raw one.
We cover wording and placement in affiliate link disclosure: where it goes and what to say. For the basics of how cloaking works and where it sits against search engine rules, start with what is link cloaking.
If you want to try it, link cloaking in WB Ad Manager is free, and the affiliate use case walks through the setup.