Google Ads Compromised Site: How to Fix the Disapproval

A Google Ads compromised site disapproval means Google believes someone has changed your website’s code without your knowledge. This guide explains what the policy covers and how to find the hidden code. It also shows how to clean your website, resubmit your ads and appeal if you think Google made a mistake.

What is a Google Ads compromised site?

Google says a compromised site is a site whose code has been manipulated to act in ways that benefit a third party. The change often harms your visitors, and the owner usually does not know about it. As a result, Google disapproves ads that lead to hijacked or hacked destinations.

So the problem is your landing page, not your ad text. Editing the ad alone will not clear it.

What does Google list as a compromised site?

Google’s list is not complete, but it names these examples:

How do you fix a Google Ads compromised site disapproval?

Google gives a clear path. Follow it in this order:

1. Confirm the issue. In Google Ads, open your ads and filter by the policy detail “Compromised site”.
2. Find the source. Read the disapproval reason. It can show the domains that load content on your page. Remove any code that points to them.
3. Scan your site. Check the Security Issues report in Google Search Console, and turn on its email alerts.
4. Check Safe Browsing. Look up your site in Google’s Safe Browsing Site Status checker. If it is listed, remove the malware and file a review in Search Console.
5. Harden the site. Update your CMS, themes and plugins, and ask a developer for a security check.
6. Use a clean destination. If you cannot fix the page, point the ad to a compliant URL.

How do you resubmit ads and appeal?

After you clean your Google Ads compromised site, resubmit your ads. Google says to allow up to 72 hours for it to recrawl and re-evaluate the page.

If you only changed the landing page, select Appeal in the ad’s status column and choose “Made changes to comply with policy”. If you fixed the destination, or you believe Google made an error, use the “Dispute” option in Policy Manager instead. Then track the result there.

Is a compromised site the same as a suspended account?

No. The compromised sites policy covers ad disapprovals and the fix above. Google lists malicious software as a separate policy, and it treats that one as egregious. For malicious software, Google says suspension happens upon detection and without prior warning.

If your whole account is suspended, read our guide to your suspension notice to match the wording to the right policy. A hacked website can also show up as a trust problem, so run our website audit checklist before you appeal.

Which mistakes keep a Google Ads compromised site disapproval alive?

• Resubmitting ads before the code is removed.
• Deleting the visible pop-up but leaving the script that creates it.
• Skipping plugin and theme updates after the clean-up.
• Opening a new Google Ads account to avoid the problem.

Frequently Asked Questions

How do I know if my website is compromised?

A Google Ads compromised site shows in the policy detail of your ads. Look there, then check the Security Issues report in Google Search Console. Unwanted pop-ups, strange redirects and unknown scripts are common signs.

How long does Google take to review my ads again?

Google says to allow up to 72 hours for it to recrawl and re-evaluate your landing page after you resubmit.

Can a hacked plugin cause a compromised site disapproval?

Yes. Google lists sites that run a content management system with known, exploited security vulnerabilities. Outdated plugins and themes are a common route.

Do I have to clean the site myself?

No. Google suggests getting a security assessment from a developer or specialist. You still need to confirm that the injected code is gone before you resubmit.

Will my Google Ads account be suspended?

Google’s compromised sites page describes ad disapprovals and a fix process. It does not describe an account suspension for this policy. However, other policy problems can lead to a suspension, so fix the site quickly.

Can you help me find the hacked code?

We review the website signals Google can see, and we point you to what needs a developer. Start with our free website scan. We cannot promise an outcome, because Google decides.