ReferenceGoogle Ads disapproval
Compromised sites
Google Ads disapproves ads whose landing page has been hacked or injected with code that steals data, installs malware, opens pop-ups or redirects visitors. Find the domains named in the reason, remove the injected code, and update the CMS and plugins. Clean the site, allow up to 72 hours for recrawling, then appeal.
At a glance
- Where it shows
- The Status column on the Ads & assets page, with the policy detail set to Compromised site.
- What stops
- The ads stop serving until the site is clean and reviewed.
- How serious
- Low on its own. Repeated violations can lead to suspension.
What it means
A compromised site has code changed by someone else, without the owner's knowledge, to benefit a third party, usually at the visitor's expense. Google's examples are card-skimming scripts, malware, unwanted pop-ups, redirects and user data taken without consent.
A site can be compromised through an outdated content management system whose known security flaws were exploited. The policy's examples include that case, so keeping the CMS and its plugins current is part of the fix, not a separate task.
What actually triggers it
A script injected into the pages
Code added to pages without the owner's knowledge, such as a script that sends form or card data to another domain.
A redirect or pop-up the owner did not add
Visitors sent to another site, or pop-ups that open on pages, when the owner added neither.
An exploited CMS or plugin
A content management system, theme or plugin with known security vulnerabilities that have been exploited.
A domain listed as unsafe
The site appears in Google's Safe Browsing site status checker as unsafe. Google's page names that checker as the way to confirm it.
Fix it in this order
- Open Campaigns, then Ads. Add a filter for the policy detail Compromised site, and note each affected ad.
- Read the disapproval reason. It names the domains the page loads content from. Find and remove the code that refers to them.
- Scan the site with the Security Issues report in Google Search Console. Google's Help for Hacked Websites covers the cleaning steps.
- Check the site in Google's External Safe Browsing Site Status Checker. If it is listed, clean the malware and file an appeal in Google Search Console to have the domain removed from the Safe Browsing threat list.
- Update the CMS, themes and plugins to their latest versions. Allow up to 72 hours for recrawling.
- Hover over the ad status, choose Appeal, pick Dispute decision or Made changes to comply with policy, select the ads and submit. Track it in Policy manager.
When to appeal
Appeal after the site is clean and the injected code is gone. Choose Made changes to comply with policy once the fix is live.
Clean the site before you appeal, since the review reads the pages as they stand when it runs.
Often confused with
Compromised sites means someone else changed the site's code. Inadequate data security means the owner's own form collects sensitive data over an unsecured page. The same site can have both, and each needs its own fix.