Fix the "Compromised site" policy in Google Ads

Google found malware or hacked content on your destination site — here is how to locate it, remove it, and get your ads back.

Your ads stopped and Google Ads shows "Compromised site" as the disapproval reason — or worse, the whole account is suspended under the policy. This is not a claim about your products or your copy: Google's Safe Browsing systems believe your destination site contains malware, hacked content, or malicious redirects. In most cases the merchant did nothing wrong; someone broke into the site, or a script it loads, and Google detected it before you did.

The unsettling part is that your site probably looks completely normal to you. Modern infections are conditional: injected code checks who is visiting and serves the malicious payload only to Google's crawler, mobile users, or traffic from specific countries — everyone else gets the clean page. That is exactly why so many merchants dismiss the flag as a false positive, appeal without changing anything, and get rejected. Google fetched your page and received something you have never seen.

Recovery has a fixed order, and skipping a step wastes weeks. First find the infection, then remove it completely — backdoors included — then request a security review in Google Search Console so your domain is cleared from Safe Browsing. Only after that flag lifts does a Google Ads re-review or appeal stand a chance. Merchants who appeal in Ads while the site is still blacklisted burn their appeals for nothing.

This is where the audit earns its keep. Our free AI audit fetches and screenshots your store the way Google's systems do — not the way your browser does — and flags injected scripts, suspicious redirects, doorway pages and third-party code that should not be there. You see the evidence Google saw, fix the right thing, and get a paste-ready appeal that describes the compromise and the cleanup in the language reviewers expect.

Run your free AI audit

See exactly what Google flagged on your store in under a minute — then get a paste-ready appeal.

Start my free audit →

450+ accounts unlocked since early 2026 · 90%+ success rate

What triggers the "Compromised site" policy

The classic hack: a few lines of obfuscated JavaScript injected into your theme or a core file, redirecting visitors to scam, pharma or adult pages. These scripts are usually conditional — they fire only for mobile users, certain countries, or Google's crawler — so you can browse your own store daily and never see anything wrong.
An outdated WordPress, WooCommerce or Magento plugin with a known vulnerability is the most common entry point. Attackers exploit it to drop backdoor files — often PHP files hidden in your uploads folder — and create rogue admin users, so the infection returns even after you delete the visible malicious code.
Spammy doorway pages generated on your domain: thousands of auto-created URLs stuffed with pharma, casino or Japanese-keyword spam, invisible from your navigation but indexed by Google. A quick site:yourdomain.com search that returns pages you never created is the giveaway — and Safe Browsing treats them as hacked content.
A third-party script you load — a chat widget, tracking pixel, review app or an old CDN — gets flagged. If the vendor is compromised or their domain lapses, every site loading that script inherits the flag. You did nothing; a supply-chain hit on someone else's code took your ads down.
An expired domain somewhere in your redirect chain. An old domain you once used, an affiliate link, or a shortener target lapses, gets re-registered by a bad actor and starts serving malware. Google follows your ad's full click path — if any hop is flagged, the destination policy fires on you.
Phishing pages planted in a forgotten corner of your server — fake bank logins or credential-harvesting forms uploaded to a subdirectory you never browse. Safe Browsing indexes them even if no link on your site points there, and the deceptive-site warning applies to your whole domain, ads included.
Scripts that push unwanted software: forced download prompts, browser-notification hijacks, or crypto-mining JavaScript quietly injected into your pages. These frequently arrive through a nulled (pirated) theme or plugin that shipped with malware baked in — the "free" premium theme is one of the oldest infection vectors there is.

How to clean the site and get your ads approved again

1
Confirm exactly what Google flagged
Open Google Search Console and check Security Issues in the left menu. If your site is flagged, the report names the category — malware, deceptive pages, harmful downloads — and lists sample URLs. Also check your ad's status in Google Ads: hover the disapproval for the policy name. If Search Console shows nothing, run the free audit — it fetches your pages the way Google's crawler does and screenshots what it actually receives, which is how conditional infections get caught.
2
Scan the site and locate the infection
Scan the site server-side, not just in a browser. Compare your CMS core, theme and plugin files against clean copies, sort files by modification date, and look for PHP files in upload directories, unfamiliar cron jobs, and admin users you did not create. Check the database too — injected scripts often live in post content or site-options tables. Remote scanners like Sucuri SiteCheck help, but they miss server-side backdoors, so file-level inspection matters.
3
Clean everything in one pass — backdoors included
Remove the injected code, the backdoor files and the rogue accounts together — a partial cleanup gets you re-flagged within days when the backdoor reinfects the site. Update the CMS, every plugin and every theme; delete anything unused or nulled. Rotate all credentials: hosting, FTP/SSH, database, CMS admins, API keys. If you have a backup that predates the hack, restoring it and then patching the vulnerability is often faster and more reliable than cleaning file by file.
4
Audit third-party scripts and redirect chains
Inventory every external script your pages load — chat widgets, pixels, review apps, fonts, old CDNs — and remove anything you no longer use or cannot vouch for. Then trace your ad's full click path: final URL, tracking template, and every redirect hop, confirming each domain is live, owned by you or a vendor you trust, and not flagged in Google's Safe Browsing site status tool. One lapsed domain in that chain is enough to trip the policy.
5
Request a security review in Search Console
With the site verified in Search Console and the infection genuinely gone, open Security Issues and click Request review. Describe what was infected, what you removed, and how you closed the hole — one or two specific sentences beat a paragraph of apologies. Malware reviews typically resolve in a few days. This step is what clears your domain from Safe Browsing, and nothing in Google Ads will approve until that flag lifts.
6
Resubmit or appeal your ads in Google Ads
Once Safe Browsing clears, go back to Google Ads. For disapproved ads, the fastest path is to open each ad, make a trivial edit and save — resubmitting forces a fresh policy review. You can also appeal directly: select the ads, choose Appeal policy decision, and pick "made changes to comply". If the entire account was suspended, use the account-suspension appeal form instead, stating the compromise, the cleanup, and the Search Console review result.
7
Harden the site so it does not happen again
Most compromised-site flags are repeat offenses because the entry point was never closed. Turn on automatic updates for CMS core and plugins, enforce two-factor authentication on every admin account, delete unused admin users, and put a web application firewall in front of the site. Keep Search Console email alerts enabled — Google notifies you the moment a new security issue is detected, usually well before your ads are hit.

Want it handled for you?

David fixes and reinstates GMC accounts directly. From $1500, full refund if we fail.

Run free audit first 💬 WhatsApp David

Frequently asked questions

What does the "Compromised site" policy in Google Ads mean?

It means Google's Safe Browsing systems detected that your ad's destination site — or something it loads or redirects through — contains malware, hacked content, phishing pages, or unwanted software. Google disapproves any ad pointing to a compromised destination to protect users who click. It is a statement about your website's security, not about your products, prices, or ad copy.

Why does Google say my site is hacked when it looks fine to me?

Because most infections cloak themselves. Injected code commonly checks the visitor's user agent, device or location and serves malware only to Google's crawler or to mobile traffic, while showing you the normal page. Browsing your own store proves nothing. Check Search Console's Security Issues report and Google's Safe Browsing site status tool, or run a crawler-perspective audit to see what Google actually received.

How do I find out exactly what Google detected?

Start in Google Search Console: the Security Issues report names the category (malware, deceptive pages, harmful downloads) and lists sample infected URLs. Cross-check your domain in the Safe Browsing site status tool in Google's Transparency Report. If both look clean but ads are still disapproved, the problem is often a flagged third-party script or a redirect hop — which is what a crawler-level scan of your pages uncovers.

Do I request review in Search Console or appeal in Google Ads first?

Search Console first. The Safe Browsing flag on your domain is what keeps ads disapproved, and only a successful security review in Search Console clears it. Once the flag lifts, resubmit or appeal the ads in Google Ads — they are then reviewed against a clean destination. Appealing in Ads while the domain is still flagged almost always fails, because the reviewer sees the same blacklisted site.

How long until my ads run again?

Search Console malware reviews usually resolve within a few days of the request; deceptive-content reviews can take slightly longer. After the flag clears, a resubmitted ad in Google Ads is typically re-reviewed within one business day. The slow path is incomplete cleanup: if the reviewer still finds infected content, the review fails and you start over, so verify the site is genuinely clean before requesting anything.

Can a Shopify app or WordPress plugin cause a compromised-site flag?

Yes. Any third-party code your pages load runs with your domain's reputation attached. A vulnerable WordPress plugin is the most common way attackers get in, and even on hosted platforms like Shopify — where the core cannot be hacked the same way — a flagged app script, theme edit, or tracking snippet can trip Safe Browsing. Audit installed apps and scripts and remove anything unmaintained.

Does a compromised-site flag affect anything besides Google Ads?

Yes — the Safe Browsing flag is domain-wide. Chrome shows visitors a red "dangerous site" warning, Google Search can label your results with "This site may be hacked", organic traffic drops, and a linked Google Merchant Center account can be suspended over the same destination. That is also the good news: one thorough cleanup and one successful Search Console review clears every surface at once.

My whole Google Ads account was suspended, not just some ads. What now?

Account-level suspension happens when Google judges the violation egregious or repeated — for example, a site that keeps getting re-flagged after reviews. The path is the same: clean the site fully, pass the Search Console security review, then submit the Google Ads suspension appeal form. In the appeal, state that the site was compromised, describe the cleanup and the closed vulnerability, and note the passed review. Do not appeal before the domain is clean.

Related guides

More fixes

Start my free audit →