A self-hosted cloaking layer for paid traffic. Twenty-three public threat feeds, browser fingerprinting, behavioral analysis, and a reputation database that learns your traffic — bundled into one PHP file per flow.
IP reputation, browser fingerprinting, behavioral analysis, geo and ASN filters — one decision API, one downloadable PHP file per flow.
firehol, spamhaus, abuse.ch, X4BNet, ipsum, AbuseIPDB, duggytuxy and more — refreshed hourly. No API keys, no per-query costs.
Canvas, WebGL, font enumeration. Catches headless Chrome, Puppeteer and Playwright that pass simple UA checks.
Mouse, scroll, touch, keystrokes, time-on-page. Catches scripts that don't move like humans.
Every check feeds a private IP reputation database. The longer it runs, the better it gets at your traffic.
Free MaxMind-compatible GeoIP. Country picker, OS, browser and device pills, GET-parameter gates.
One file you drop on your domain. Decides at the edge — visitor sees safe page or offer page based on dozens of signals.
Per-IP daily caps. Warmup mode (first N clicks → safe). Pause flows from the dashboard without touching your server.
Seven presets for Facebook, Google, TikTok, native, strict and permissive. Pick one, the right toggles flip on.
Paste any IP and UA. See the verdict, the score, every signal raised. Test before you ship.
No SDK, no infra to provision. One PHP file per flow, dropped at your domain root.
Pick a template, set safe + offer URLs, tweak filters in the dashboard.
One self-contained file. Encodes your API key, every filter, the bot fast-path list.
Drop at the document root. Visitors hit / and the file routes them.
Per-flow allows, blocks, top countries, top reasons. Use the IP lookup tool to test edge cases.
Most cloakers nickel-and-dime per check or bury features behind enterprise plans. We are flat-rate, self-hostable, and source-open.
| Feature | Cloackit | Cloaking.House | Others |
|---|---|---|---|
| Free tier | 5,000 checks/mo | Trial only | Trial only |
| Public threat feeds | 23 free, hourly | Opaque | Opaque |
| Self-growing reputation | Yes | No | No |
| Browser fingerprinting | Canvas + WebGL + fonts | No | Some |
| Behavioral signals | Mouse, scroll, touch | No | No |
| Downloadable PHP per flow | Yes | Yes | JS embed only |
| IP lookup tool | Built in | No | No |
| Self-hosted option | Free, unlimited | No | No |
| Pricing model | Flat monthly | Per click + monthly | Per click |
Quick answers to what people ask first.
The PHP fast-paths obvious bots in under 1 ms with no API call. For everyone else it's one HTTP call to the engine — typically under 50 ms p95. Real visitors see the offer essentially instantly.
Yes. The PHP reads CF-Connecting-IP first, then X-Real-IP, then X-Forwarded-For, then the socket. Works behind any reverse proxy that sets one of those.
Yes. Node, SQLite, twenty-three cron-pulled feeds. Drop the .env, point your PHP at it. No license, no quotas, source available.
One call to /api/v1/check. Visitors filtered by the local fast-path UA list don't count. You get an email warning at 80% of quota and there are no overage charges.
For each check we log IP, country, ASN, UA, verdict and reasons — for your own dashboard. Data is yours, deletable on request, never shared.
Cloaking has many legitimate uses: geo-targeting, A/B testing, paywalls, region-locked content. Misuse to deceive ad reviewers is your call and your liability.
Five thousand free checks per month. No card. No setup call.
Create your free account