Use Google's definition before the checklist
Google defines cloaking as showing different content to users and search engines with the intent to manipulate rankings and mislead users. Its examples include serving one topic to Google and another to people, or inserting ranking text only when the requester is a search crawler.
The intent and consequence matter. A mobile layout, language negotiation, accessibility adaptation, or paywall implementation is not made safe by being complicated, nor made spam merely by being different. The question is whether Google can access the same substantive content available to the corresponding person and whether the difference is designed to deceive the result.
Build a parity comparison
Capture the final rendered page in several conditions: an ordinary logged-out browser, Google's URL Inspection rendering, a direct request with crawler headers where appropriate, mobile and desktop, and any location or session states that affect content. Record response codes, redirects, canonical tags, visible text, links, and injected content.
Do not stop at view-source. Differences can enter at the CDN, server, application, tag manager, consent layer, JavaScript bundle, or compromised third-party script. A useful comparison identifies the first layer where the two responses diverge.
Distinguish manipulation from a hacked site
Google notes that hacked sites may use cloaking to hide injected pages from the owner. If the difference was not intentionally deployed, inspect the Security Issues report, server access, application users, recent file changes, scheduled tasks, plugins, DNS, and third-party scripts. Removing the rendered spam without closing the entry point invites it back.
If Search Console shows a cloaking manual action, use its affected pattern to verify every relevant template or serving rule and follow the manual-action review sequence.
Repair the serving logic, then prove parity
Remove crawler-specific text and redirects, make legitimate gated content follow Google's documented sampling rules, and ensure essential content is accessible to both Search and the intended user. Retest the same condition matrix after the change.
The evidence belongs in the reconsideration work log if a manual action exists: affected rules, code or configuration changed, representative URLs, security repair where applicable, and final rendered comparisons. “We removed cloaking” is a conclusion; the parity captures show why it is true.