Link cloaking
Keep your branded address visible while displaying a compatible destination page within your short link.
What is link cloaking?
A standard short link redirects visitors to the destination website, and the browser's address bar updates to show that site's URL.
Link cloaking displays a compatible destination page inside an embedded frame. Visitors continue to see your short link in the address bar, such as goose.re/my-offer, while interacting with the destination content.
Common use cases
Affiliate marketing
Present a concise branded address while displaying a compatible partner page. Confirm that the destination permits framing and that your affiliate program allows this presentation before using it in a campaign.
Consistent branding
Keep your domain visible when presenting an external page that supports embedding. Test the full visitor journey, including forms and navigation, to confirm the experience works as intended.
Limitations
The destination website must allow its pages to be embedded.
A destination can block framing through X-Frame-Options or Content Security Policy (CSP) headers. The browser may then show an error or an empty frame. Test every cloaked link before sharing it, and use a standard redirect if the destination does not support embedding.
Configuring a destination you control
If you manage the destination website, review its framing policy with your developer. Allow the origin used by your short link while retaining the protections your site needs.
1. Update Content-Security-Policy (CSP)
Use the frame-ancestors directive to specify which origins may embed your pages. Include the Goose.re origin or your custom domain, adjusting the example to match your setup.
Content-Security-Policy: frame-ancestors 'self' https://goose.re https://yourcustomdomain.com;
2. Review X-Frame-Options
Review any X-Frame-Options header alongside your CSP configuration. The legacy ALLOW-FROM example below is obsolete and should not be used for new configurations. Use CSP to define the allowed origins and have your developer resolve any conflicting headers.
X-Frame-Options: ALLOW-FROM https://goose.re