Create your first cloak rule: modes, real and safe pages, country and device limits, and testing

A cloak rule decides, for each ad link, who sees the real page and who sees the safe page: crawlers, data-center traffic and visits from outside your target region see the safe page, while real customers who meet your conditions see the real page. It is positioned as an invalid-traffic and crawler filter. This guide walks you through building your first rule in the Cloak List from scratch and checking its decisions after you save. The interface changes slightly between releases, so go by what you actually see.

Create the rule and fill in the basics

Start with the name, platform and mode in the "Basics" section.

1. Open "Cloak List" in the left menu and click "Create cloak" at the top right (with no rules yet, the button in the middle of the page reads "Create your first cloak"). The "Create Cloak Rule" drawer slides in from the right with four sections, "Basics", "Links", "Filters" and "Advanced", and three buttons at the bottom: "Cancel", "Save and test" and "Save Rule".
2. Give the rule an easy-to-spot name in "Rule Name", for example "FB-US-Shoes-Bestseller-01". "Remark" is optional and only visible to you; you can click the remark text in the list to edit it later.
3. Under "Ad Platform", pick Facebook / Meta, TikTok, Google Ads or "Universal / Other". The switches in the "Filters" section are then preset to that platform's recommended values; you can still change each one afterwards.
4. Under "Mode", choose one of four (each card has a one-line description). The next section explains how they differ. Choosing "In review", "Open" or "Bots only" shows a note under the cards.

How the four modes differ

The mode decides how many of the switches in "Filters" actually take part in the decision. You can also click the mode tag on a row in the list to switch quickly.

• Cloak: filters by the switches in the rule. Reviewers, crawlers, data-center IPs, visitors outside the target countries and unsupported devices see the safe page; real customers see the real page. This is the most common mode.
• Bots only: only blocks crawlers and data-center IPs; everyone else sees the real page. Country, device, language and other filter switches are ignored.
• Open: only the blacklist and the review-shield library stay on; everyone else sees the real page and all other filter switches are ignored, which raises the risk of being banned by the ad platform. Switching to "Open" in the list asks you to confirm.
• In review: every visitor, whitelisted IPs and real customers included, sees the review page. Use it while the platform is reviewing. Click "Send to review" on the row to switch; when the review is over, click "Restore" to go back to the mode it had before.
• While a rule is in review, real customers only see the review page too, so remember to click "Restore" as soon as the review ends.

Set the real page and the safe page

In the "Links" section, tell the system what each group of visitors sees.

1. "Domain": pick a verified domain from the dropdown, or click "Add domain" to add one in place and finish the DNS verification as prompted; it can only be used once verified. Without a domain, visitors use the link provided by the system; if no delivery domain is available, clicking "Copy link" in the list asks you to bind your own domain first.
2. "Buyer Money Page": choose the source first. "External URL (reverse proxy)" takes a real link starting with http:// or https://; click "Add a real link" to add several (the same visitor always sees the same one, and the next one is tried automatically when a link fails). "Internal landing page (Library B)" takes a published landing page. "Payment site" takes a site you already created.
3. "Review Intercept Action" sets where the safe page comes from. "Built-in Compliant White Page" lets you choose a category and an optional brand name (left blank, one is generated) and click "Preview This Page" first. "Custom External Safe Page URL" takes the address of a public site that the system serves on your own domain without changing the address bar. "Internal landing page (Library A)" takes a landing page you published, with all pixels and tracking scripts stripped on output. "404 Disguise" returns a 404.
4. If both the real page and the safe page use an internal landing page, do not pick the same one: when Library A and Library B use the same page, the interface warns that reviewers would see the real page, so there is no isolation.
5. The safe page should be complete, credible and reachable. For the first ad review, avoid "404 Disguise"; the interface carries the same warning.
6. With "Internal landing page (Library A)" you can fill in "Share preview (OG) override" below it; crawlers and social platforms only ever see the title, description and image given there.

Limit countries and devices

Set the visitor conditions in the "Filters" section. Note that country, device and language switches only apply in "Cloak" mode; "Bots only" and "Open" ignore them.

1. "Target Country Whitelist" defaults to "Global (no geo filter)". Choose "Whitelist selected countries only", then search with "Search countries…" and tick your target countries; "N selected" appears below. Visitors from other countries see the safe page.
2. "Allowed Device Types": tick Mobile, Tablet and Desktop. Ticking none means no device restriction; with only "Mobile" ticked, desktop and tablet visitors see the review page.
3. Turn on the switches you need: "Block Datacenter / Cloud IPs", "Block Ad Platform Review Crawlers", "Block Chinese-Language Devices", "Block empty language" and "Allow Apple Private Relay". Each has a one-line description; if you are unsure, keep the platform preset.
4. To send visitors who may or may not be bots through a human check instead of straight to the safe page, turn on "Gray-zone visitor verification (Turnstile)" and set "Risk score ≥ N triggers verification". If the interface says the verification keys are not configured on the server, no challenge is shown and gray-zone visitors are let through as before.

Advanced: review window lock, frequency cap and intel fallback policy

Everything under "Advanced" is optional. You can build and test the rule first and tune these later.

1. "Review Window Lock": when on, the review page is always shown for the first N hours (1–72) or the first N clicks (1–200) after launch; normal routing resumes automatically afterwards.
2. "Anti-Repeat Click / Frequency Cap": when on, the same visitor (or IP) sees the real page at most N times (1–50) per 24 hours; after that they get this rule's safe page.
3. "Intel fallback policy": what this rule does with visitors when the IP intelligence service times out or errors. "Follow system default" uses the platform-wide setting; "Allow (keep judging by other filters)" keeps judging by the other filter switches; "Show safe page (never risk the real page)" shows the safe page to every affected visitor. If unsure, keep "Follow system default".
4. "Honeypot trap" hides a link people cannot see in the page; only crawlers follow it, and every hit is recorded. "Transparent Ad Param Passthrough" forwards fbclid, ttclid, gclid and UTM parameters to the destination. Turn them on as needed.
5. "Custom Short-Link Suffix": leave it empty to get a generated 6-character code; the link looks like /c/code. "IP Whitelist" and "IP Blacklist" take one IP or CIDR per line. If a whitelisted IP is also in the review-shield library, the interface shows a yellow warning (the whitelist wins, so those IPs go straight to the real page). The whitelist does not apply in review mode.

Save and test with the X-ray

Do not start running traffic right after creating the rule. Check its decisions first.

1. Click "Save and test" at the bottom. The rule is saved, the drawer stays open, and a "Test run" window appears with three simulated visitors side by side: Reviewer, Real user and Crawler. Each shows whether it sees the "Real page", "Safe page", "404 page" or a "Human check", plus the "Reason".
2. Compare with what you expect: the real user should see the real page and the crawler should see the safe page. If not, go back to the drawer, adjust the mode or switches and click "Save and test" again. This is a read-only simulation: no visit records and no billing.
3. The grey text at the bottom of the window lists what the simulation leaves out (live paid IP intel, review-period click counts, frequency counters and actually running a human check), so real visitors may be treated more strictly. You can rerun the simulation any time with the "Test" icon on the row in the list.
4. Click "Save Rule" to close the drawer, confirm the status in the list is "Active", click "Copy link" on the row and open it once on your phone (preferably on mobile data).
5. Back in the list, click the "Visit log" icon on the row (or open "Visit Logs" from the left menu and filter by this rule), find that visit and click "Diagnose / Trace" on the right. The "Full X-ray · Verdict replay" drawer slides in and replays step by step why the visit was allowed or blocked, so it is no longer a black box. "Search by IP" helps you find your own record quickly.

Settings that do not apply on PWA links

The same cloak rule can also be bound to a PWA promo link. But the following three settings only apply to /c/ cloak links and have no effect on PWA links:

• Review-period safety lock
• Human verification
• Frequency cap
• When a rule has any of these turned on and is also used by a PWA link, a "Partly inactive on PWA" tag appears under its name in the Cloak List, and a yellow notice appears in the PWA "New link" drawer when you pick the rule. It is only a reminder and does not block saving.
• The intel fallback policy is supported on PWA links. When a rule is paused or in review mode, PWA links bound to it only show the safe page; the same happens when the rule is in the recycle bin, until you bind another rule or restore it.

Compliance reminder

• swifttu is positioned as an invalid-traffic and crawler filter: it helps you tell bots, crawlers, data-center traffic and visits from outside your target region apart from real customers.
• Do not use it for anything illegal, fraudulent, counterfeit, or that impersonates someone else's brand. Both the real page and the safe page must be truthful, lawful and reachable.
• Also follow the laws of your region and the advertising policies of each ad platform. Rules, links or accounts that violate them may be restricted.