Fix: White Page Shown to Everyone

White page shown to everyone is one of the most expensive cloaking bugs there is: even paid, on-target traffic sees the safe white page instead of the offer, and every click burns budget with zero conversions. The cause almost always sits in one of three places — antibot rules, traffic parameters, or caching. Here's how to find your specific cause fast and fix the display.

What white-to-everyone means and why it's expensive

On every hit, the cloak decides whether to show the safe white page or the offer's black page, based on signals like geo, device, behavior, and whether the ad platform's parameters are present in the link. When that logic breaks and white goes to everyone, including honest paid traffic from ads, you're still paying for the clicks and nobody ever reaches the offer. This isn't a cosmetic bug — it's budget bleeding out in real time, so it needs fixing immediately, not after the day's report.

Cause #1: antibot rules set too aggressively

The most common cause is geo/UA/IP filters tuned overly defensively, which end up cutting real users along with bots — mobile carriers that IP-intel flags as datacenter ranges, or geos where legitimate VPN use is common. If a noticeable share of real clicks gets caught by a filter, the result looks exactly like white going to almost everyone. The first move is checking the antibot logs for the actual block reason per request, instead of guessing.

Cause #2: traffic parameters never reach the cloak

The cloak tells ad traffic apart from direct visits using link parameters — click ID, sub-parameters, referrer. If the ad platform or tracker strips those on the way through (a redirect that drops the query string, a malformed link, a carrier-side caching proxy), the cloak sees no signal that this is ad traffic and defaults to the safe scenario. Check this by inspecting the actual link a real click landed on and comparing it against what the rules expect.

Cause #3: service worker or CDN cache serving a stale version

If you just updated the cloaking rules and nothing changed, there's a good chance users are getting a cached white page from an old service worker version or through the CDN. The browser doesn't always pick up the new version immediately, especially without a forced cache reset built into the deploy. In that case the rule is technically already correct — it just isn't applied yet for everyone, so the fix is forcing a cache refresh, not rewriting the rule again.

Diagnostic checklist

Start with the antibot logs in your dashboard — they show the exact block reason per request instead of just a total number. Test from a real mobile IP in the target geo, not your home or office connection — an office IP is often flagged as datacenter on its own and will show white regardless, which creates a false sense that something's broken. Confirm click ID and sub-parameters make it through to the destination link intact, and force a cache reset after any rule change before you retest. If white is still overrepresented after checking all three, loosen the filters selectively instead of turning antibot off entirely.

FAQ

How do I see how much traffic actually went to the white page?
The antibot logs in the APEX dashboard show the decision reason for every request, so you can calculate the white share and see which filter is driving it up.
Why do I always see the white page when testing from my own computer?
Home and especially office IPs are frequently flagged as datacenter or carry other off-target signals, so an honest test needs a real mobile IP from the target geo, not your own connection.
Can a stale PWA cache cause this even if the cloaking rules are correct?
Yes — if the service worker or CDN is serving a cached white page, the new rules simply aren't applied yet for some users until that cache refreshes.
The ad platform's reviewer sees the white page — is that a problem?
No, that's expected and correct for review accounts and platform bots — it's only a problem if a real target user sees it.
Build your PWA in APEX in minutes

Cloaking, anti-bot, push, split tests and your own domains — in one service.

Get started free

Read also