Link Cloaking

Mask the final destination URL so visitors only see your clean, branded short link in their browser's address bar.

What is Link Cloaking?

Normally, when a user clicks a short link, their browser performs an HTTP redirect and the address bar updates to show the final, long destination URL.

Link Cloaking changes this behavior. Instead of a standard redirect, Goose.re loads the destination page inside a secure frame. The user's browser address bar will continue to show your short link (e.g., goose.re/my-offer) instead of the messy destination URL.

Without Cloaking (Address Bar changes)
https://verylong-affiliate-store.com/ref=12391283?utm_source=...
With Cloaking (Address Bar stays clean)
https://go.yourbrand.com/summer

Common Use Cases

Affiliate Marketing

Hide complex affiliate tracking parameters from your visitors. They only see your trusted domain, which protects your commissions and looks significantly more professional.

Brand Protection

When linking to third-party tools (like a Typeform or a Google Doc), keeping your own domain in the address bar ensures the user feels like they never left your brand ecosystem.

Important Limitations

Not all websites allow themselves to be cloaked (framed).

Many major websites (like Google, Facebook, Twitter, and most banks) use a security header called X-Frame-Options: DENY or restrictive Content Security Policies. If you attempt to cloak a link to one of these sites, the browser will block it and show a blank white page. Always test your cloaked links before distributing them!

Allowing Your Site to be Cloaked

If you own the destination website and you want to allow Goose.re to cloak it, you will need to update your server's security headers.

1. Update Content-Security-Policy (CSP)

The most modern way to allow framing is by using the frame-ancestors directive in your CSP header. You should add the Goose.re domain (or your custom domain) to the allowed list.

Content-Security-Policy: frame-ancestors 'self' https://goose.re https://yourcustomdomain.com;

2. Modify X-Frame-Options

If your server sends an X-Frame-Options: DENY or SAMEORIGIN header, legacy browsers will refuse to render the page inside a Goose.re frame. You can either remove this header (if you are fully relying on CSP) or change it to allow specific URIs (though this is obsolete in modern browsers compared to CSP).

X-Frame-Options: ALLOW-FROM https://goose.re