ReferenceGoogle Ads account suspension
Malicious software
Google suspends an account on detection, with no warning, when its ads, site or app distribute malicious software or link to it. That covers a download bundled with spyware, a forced redirect to an infected site, and credential-stealing ad formats. Check every download, redirect and third-party script you use, clean up what fails, then appeal through the contact link in the notice.
At a glance
- Where it shows
- The suspension notice at the top of the account, which names the policy.
- What stops
- Every campaign in the account stops serving at once.
- How serious
- Severe. The account is suspended on detection, with no prior warning, and reinstatement happens only in compelling circumstances.
What it means
The policy covers software built to harm a computer, device or network, or to gain unapproved access to one. Google's examples include computer viruses, ransomware, worms, trojan horses, rootkits, keyloggers, spyware and rogue security software.
The rule reaches past your own ads. It covers any software your site or app hosts or links to, whether or not that software is advertised through Google's network. A download link on a page you control can put the whole account at risk, even when the product you sell is clean.
What actually triggers it
A download with unwanted software bundled in
A free tool, plugin or installer offered from the site that carries spyware, a keylogger or another program from Google's list that the visitor did not ask for. Check the installer itself, not only the page that links to it.
A forced redirect the visitor never clicked
Google lists forced redirects to a site infected with malicious software, without the user clicking the ad, as a prohibited practice. Open the landing page and follow every redirect it makes, in a clean browser, and note where it ends.
An ad format that steals login details
Google lists HTML5 ads that steal user credentials from a publisher's page as malicious software. Check any third-party ad, widget or tracking code added to the pages, since it runs on them.
Fix it in this order
- Open the suspension notice and confirm it names Malicious software. If it names a different policy, use that policy's page.
- Scan the site, and the app if the account advertises one, with a security scanner. Check every file in every download the site offers.
- List every download link and every outbound link on the landing pages. Open each destination in a clean browser and remove any download you cannot vouch for.
- Remove any third-party script, widget or ad code that redirects visitors or offers software. Test the landing page again after each removal, until it loads with no redirect and no extra software offered.
Appeal from the contact link in the suspension notice once the clean-up is done. Say what was found, what was removed and how you checked the result.
When to appeal
While an appeal is pending, the account shows Appeal pending. The outcome arrives by email.
If the account requires identity verification, complete it first. After three failed attempts the account cannot appeal.
Send an appeal only when the clean-up is done and you can prove it. Google reinstates in compelling circumstances, such as a mistake, and a rejected appeal can be sent again through the same process.
Often confused with
A separate policy about disclosure: software that promises value it does not deliver, collects private information without the user's knowledge, or is hard to remove. It disapproves the ad rather than suspending the account, and the fix is what the ad and landing page say about the product. Read the policy the notice names, since the name decides which page applies.
A landing page hacked or injected with code by someone else is handled under its own policy, which disapproves the ads until the site is clean. The malicious software policy is worded around intentional distribution and suspends the whole account, so the name in the notice decides which clean-up and which appeal apply.