Policy Background

In May 2023, Google Ads updated its "malware or unwanted software" policy, splitting it into three separate policies:

1. Malware policy — targets software designed to harm or exploit systems
2. Compromised sites policy — targets sites that have been hacked or infected
3. Unwanted software policy — targets deceptive or harmful software downloads

Reference: Google Ads Policy — Abuse of the ad network

What is a "Compromised Site"?

A compromised site is one where a third party has injected malicious code without the site owner's knowledge. Common examples include:

• Injected JavaScript that redirects visitors to phishing pages
• Hidden iframes loading malware downloads
• SEO spam injections (pharmaceutical, gambling links inserted into pages)
• Backdoor scripts that give attackers ongoing access

Google detects these issues through its Safe Browsing system and will disapprove any ads pointing to compromised URLs.

How to Diagnose the Issue

1. Check Google Search Console: Go to Security & Manual Actions → Security Issues. If your site is flagged, Google will show the type of compromise detected.
2. Scan with Google Safe Browsing: Visit Google Safe Browsing Transparency Report and enter your URL.
3. Use Sucuri SiteCheck: sitecheck.sucuri.net provides a free scan that identifies known malware and blacklisting status.
4. Check ad disapproval reason in Google Ads: In your Google Ads account, hover over the disapproved ad's status to see the specific policy violation.

Step-by-Step Fix

Step 1: Isolate and Identify the Malicious Code

1. Put your site into maintenance mode if possible
2. Check recently modified files (sort by date in your file manager or use SSH: find . -mtime -7 -name "*.php")
3. Look for suspicious patterns: eval(base64_decode, str_rot13, gzinflate, unexpected <iframe> tags, or <script> tags pointing to unknown domains

Step 2: Remove the Malicious Code

1. Delete injected files and code blocks
2. Restore from a known-good backup if the infection is widespread
3. Update all CMS, plugins, and themes to their latest versions
4. Change all passwords (admin, FTP, database, hosting control panel)

Step 3: Patch the Underlying Vulnerability

• If using WordPress: Update all plugins and themes, remove unused ones, install a security plugin (Wordfence, Sucuri)
• If using Shopify: Review installed apps, remove any suspicious ones, check theme code for injections
• If custom-built: Audit input validation, SQL injection vulnerabilities, and file upload handlers

Step 4: Request a Review

1. In Google Search Console → Security Issues, click "Request Review"
2. Explain what was compromised, how you fixed it, and what steps you've taken to prevent recurrence
3. Submit the review request — Google typically processes it within 72 hours

Once Search Console clears the flag, your Google Ads disapprovals should resolve automatically. If they don't, contact Google Ads support directly.

Prevention Best Practices

• Keep all software (CMS, plugins, themes) updated to the latest versions
• Use strong, unique passwords and enable two-factor authentication
• Install a Web Application Firewall (WAF) like Cloudflare or Sucuri
• Regularly back up your site to a separate location
• Monitor your site with Google Search Console and Sucuri
• Limit file upload capabilities and use SFTP instead of FTP

Conclusion

Compromised site disapprovals can be stressful, but they follow a predictable pattern: diagnose → clean → patch → request review. The key is speed — the faster you identify and remove the malicious code, the sooner your ads resume serving. Invest in prevention to avoid repeat incidents.