Link Cloaking in CodeQR: How to Mask URLs
Learn how to use link cloaking in CodeQR to mask destination URLs with short links.
CodeQR Team
Team Contenuti
Learn how to use link cloaking in CodeQR to mask destination URLs with short links.
Como Criar QR Codes via API da CodeQR: Guia Completo
This feature is available only for Pro plans and above.
With CodeQR, you can mask your destination URL using your short link.
To enable link cloaking, click to activate Add Link Cloaking in the link builder.
This is useful when you want to display your brand or custom domain instead of the actual destination URL.
When enabled, your short link will be shown in your users’ browser address bar when they visit your link, instead of the destination URL.
Link cloaking works by embedding the destination page in an iframe inside a page hosted on your short domain. This means:
Some important limitations of the link cloaking feature:
For link cloaking to work, make sure to use https for your destination URL. If your destination URL is http, the browser will display a “Not Secure” warning, and link cloaking will not work.
Link cloaking may not work with certain sites that have security measures in place to prevent this:
If you control the destination URL you are masking, you can use security headers to enable link cloaking in CodeQR while also disabling iframe embedding elsewhere.
To do this, you need to include your CodeQR short domain as an allowed source on your site by adding the following response headers to your website:
Content-Security-Policy: frame-ancestors 'self' [seudominio.com]
For example, if your CodeQR short domain is meulink.com, you would need to add the following headers to your destination URL:
Content-Security-Policy: frame-ancestors 'self' meulink.com
You can also include multiple domains by separating them with a space:
Content-Security-Policy: frame-ancestors 'self' meulink.com outrodominio.com
This will ensure your site cannot be embedded on third-party sites, but can still be masked by your CodeQR short domain.
Add to your .htaccess file:
<IfModule mod_headers.c>
Header always set Content-Security-Policy "frame-ancestors 'self' seudominio.com"
</IfModule>
app.use((req, res, next) => {
res.setHeader('Content-Security-Policy', "frame-ancestors 'self' seudominio.com")
next()
})
add_header Content-Security-Policy "frame-ancestors 'self' seudominio.com" always;
You can set up link cloaking to work only under certain conditions:
// Exemplo para habilitar cloaking apenas para referrers específicos
if (document.referrer.includes('seudominio.com')) {
// Permitir iframe
res.setHeader('X-Frame-Options', 'SAMEORIGIN')
} else {
// Bloquear iframe
res.setHeader('X-Frame-Options', 'DENY')
}
For sites that need to detect when they are displayed in an iframe:
// Verificar se a página está em um iframe
if (window !== window.top) {
// Página está em iframe (provavelmente via link cloaking)
console.log('Página exibida via link cloaking')
} else {
// Página acessada diretamente
console.log('Acesso direto à página')
}
Issue: The destination page does not appear Solutions:
Issue: Forms or JavaScript do not respond Solutions:
Issue: Browser displays warnings Solutions: