Cloaking — also called URL masking — means your short link stays in the address bar while the real destination loads behind it. Visitors see go.yourbrand.com/sale rather than a partner URL with an ID in it.
Visib does this, but it is not what Visib is for. The address bar is a side effect of framing the page; the point of framing the page is that your CTA can sit on top of it. Cloaking gives you a clean URL. The CTA is what gives you the second click.
White-hat vs the thing that gets you penalised
Masking an affiliate URL is not the cloaking Google punishes. Google's spam policies target serving different content to search engines than to people in order to manipulate rankings. With a masked link, everybody lands on the same page. Different practice, same word.
Ad cloaking — showing ad reviewers a safe page and real users something else — is a third thing, it is deceptive, and it is nothing to do with this.
Redirects do not cloak
A 301, 302 or 307 tells the browser to navigate, so the address bar becomes the destination. That is the opposite of masking. Meta-refresh and JavaScript redirects do the same thing, more slowly. The only technique that keeps your URL visible is framing the destination inside a page served from your domain — which is what Visib does, because it is also what lets your CTA exist.
The limit nobody likes to print
Any destination sending X-Frame-Options: DENY or SAMEORIGIN, or a CSP frame-ancestors restriction, cannot be framed. Google, YouTube, the big social platforms, PayPal, banks, and most logged-in apps all do. No tool masks those — the browser decides, not the vendor.
What differs between tools is the failure mode. Visib checks the destination while you are creating the link and warns you, and if a frame fails at runtime the visitor is forwarded to the destination instead of staring at a blank page. When you need the overlay on a site that blocks framing, capture a snapshot instead.
When not to cloak
- Amazon Associates. Their agreement forbids hiding that the link goes to Amazon. Do not do it.
- Paid ad destinations. Ad platforms flag masked links as sneaky redirects. Send ads to a plain branded redirect.
- Anything needing a login. Sign-in inside a third-party frame is blocked by browsers.
- Pages whose own analytics you care about. Framing plus a suppressed referrer distorts their attribution.
Two things masking does not change
It is not a disclosure. If you have an affiliate relationship, the FTC still requires you to say so, and hiding the ID in the URL changes nothing about that. And it is not a ranking tactic — if you want to consolidate signals to a page you own, use a clean 301.
