How do I mask or cloak a short link?

Updated September 29, 2026

Link cloaking is a per-link switch on Pro plans. With it on, Flyn serves your short URL as the page itself and loads the destination inside a frame, so the visitor's address bar keeps showing your short link instead of a long destination full of tracking parameters. When a destination refuses to be framed, or Flyn cannot confirm that it allows it, Flyn sends the visitor straight there instead, and the real URL becomes visible.

Turn cloaking on

Step 1: open the link's Advanced settings

For a new link, open Links in your dashboard, click Create Link, enter your destination, then open the Advanced tab.

For a link you already made, open the Links page and click the pencil icon on the link's row.

The Link Details panel opens as a vertical list of sections; click Advanced to expand it.

Step 2: flip Link Cloaking

Turn on the Link Cloaking switch. In the create form it reads "Cloaking enabled" once it is on.

While cloaking is on and a destination is filled in, Flyn checks that destination's headers in the background. If the site refuses framing, an amber warning appears under the toggle saying cloaking will not work for that URL. If Flyn cannot confirm the site allows framing (for example, it answered with an error or a bot challenge, or did not answer in time), the warning says cloaking may not work instead, because visitors then get a plain redirect too.

Step 3: save

In the create form, click Create Link. In the Link Details panel, click Save (the button appears once you change something).

On a free plan the Advanced settings show cloaking as locked with an upgrade prompt, and the API rejects cloaking on both link creation and link updates.

What the visitor sees

The address bar keeps the short URL, on whatever domain the link uses: a Flyn domain, or your own if you have a custom domain connected.

The cloaked page shows the framed destination. There is no Flyn logo, no toolbar, and no visible link that exposes the real destination. Flyn used to paint a bar with an "Open directly" link on cloaked pages; both were removed in July 2026.

The destination URL is still in the page's source, since the frame has to point at it. Cloaking hides the destination from the address bar, not from someone who inspects the page.

The browser tab title comes from the link's social preview title if you set one, then the link's title, and falls back to the short URL itself when neither is set. Cloaked pages also carry noindex, nofollow, noarchive, so they are not meant to be indexed.

A cloaked link records the click the same way a normal redirect does, so cloaking does not cost you analytics.

Why cloaking sometimes does not work

The destination forbids framing

This is the common one, and it is not something Flyn can fix. Many sites send an X-Frame-Options header (DENY or SAMEORIGIN), or a Content-Security-Policy with a frame-ancestors rule. Those headers tell the browser which sites, if any, may load that page inside a frame, and a cloak page served from a Flyn or custom domain is not the destination's own origin. The headers come from the destination, so an iframe-based cloak like Flyn's cannot override them.

Flyn handles it in the link editor and again at click time:

• Before you save. The link editor probes the destination and warns you upfront when the headers refuse framing, or when it cannot confirm framing is allowed.
• At click time. Flyn reads the destination's headers again before serving the cloak page, and serves it only when the destination's answer shows framing is allowed. When the headers refuse framing, or the site answers with an error or a bot challenge, or does not answer in time, the visitor gets a plain redirect (after Flyn's brief pixel page, if the link has retargeting pixels) instead of a possibly broken frame. They reach the destination, but the address bar shows the real URL.

The check can still miss a refusal: when a site sends different headers from one request to the next, when it shows Flyn's check a different page than it shows a browser, or when it changes its headers after Flyn last checked (Flyn reuses a check's answer for up to 10 minutes). A script on the cloak page then tries to spot the blocked frame and forward the visitor, but browsers do not reliably let a page see that its frame was refused, so the visitor can be left looking at a blank, blocked frame instead of the destination.

Some destinations therefore cannot be cloaked at all. If yours sets those headers, or blocks automated checks, the honest options are to accept the plain redirect or to point the link at a page you control.

The destination is not an https URL

Cloaking applies to https destinations. A plain http page cannot be framed inside the cloak page, which is served over https, so an http destination gets a plain redirect. The same goes for an https link that redirects to an http page. Anything else, such as a mailto: or tel: link, is sent to the destination without cloaking.

Another setting on the same link takes priority

These settings run before cloaking:

• Click limits. Once a link reaches its click limit, visitors go to the link's fallback URL as a plain redirect, or to a dead-link page when no fallback is set. A cloaked link at its cap stops being cloaked.
• Password protection. A password-protected link shows the password gate, and after the right password the visitor is sent straight to the destination, so a password-protected link is never cloaked.
• Deep Links. If Deep Links is on (in the link's Routing settings) and the destination is an app Flyn recognises, the visitor's browser user-agent decides: one reporting iPhone, iPad, iPod, or Android gets the app handoff page instead of the cloak, and anything else continues to the cloak, which is still served only when the destination allows framing.

You are on a free plan

Cloaking is Pro. If the setting does not stick after saving, check your plan first.

Trying it without an account

The link cloaker tool shows what your cloaked link would look like on a branded domain. It is a preview: it does not create a live link, and links made anonymously with the free tools cannot be cloaked. You need an account and a paid plan for a working cloaked link.

Cloaking not behaving the way this article describes? Email [email protected] with the exact short link and its destination URL, the two things needed to look at the link's settings and the destination's headers.

Did this answer it? If not, email [email protected] and a human will help.