- Compromised site: your site was hacked. Ads are disapproved, with at least 7 days' warning before a suspension.
- Malicious software: deliberately spreading malware. Google suspends without warning.
- Search Console's Security issues report and Google's Safe Browsing site status tell you what Google has found.
- Clean the site, update everything, then ask Google to review. Google says to allow up to 72 hours for its recrawl.
Compromised site or malware: which is it?
| Compromised site | Malicious software | |
|---|---|---|
| What it means | Your site was hacked: someone added code without your knowledge | Deliberately distributing software that harms devices or steals access |
| Examples | Card skimmers, injected pop-ups, unwanted redirects, hidden spam, an exploited out-of-date platform | Viruses, ransomware, spyware, forced redirects to infected sites |
| What Google does | Disapproves ads, and warns at least 7 days before suspending the account | Suspends on detection, without warning |
| Getting back | Clean the site, then appeal the ads or request a review | Google says accounts are only reinstated in compelling circumstances |
Both come from Google's Google Ads compromised sites policy and Merchant Center's abuse of the network policy. If you didn't knowingly add anything harmful, you're almost certainly dealing with a compromised site.
Signs your site has been hacked
Pages you didn't create
Spam pages about pills, casinos or loans, sometimes in other languages, showing up in Google under your domain.
Redirects only some people see
Visitors on phones, or arriving from Google, get sent to another site while you see your shop normally.
Hidden links or text
Spam links hidden in your pages' code where visitors can't see them.
New pop-ups or scripts
Pop-ups, payment forms or scripts you didn't add, especially on the checkout.
Google's warnings
A red 'deceptive site' or 'dangerous site' warning in browsers, or a Security issues message in Search Console.
Unknown admin users
Admin accounts on your site or hosting that nobody on your team created.
How to clean up and get ads running again
- 1
Find out what Google found
In Google Ads, filter your ads by Policy details: Compromised site and read which domains are named. In Search Console, open Security issues. Check your domain in Google's Safe Browsing site status checker.
- 2
Clean the site
Remove the injected code and anything that loads from the domains Google named. Use Google's Help for hacked websites, or ask your developer or host. On WordPress, a security plugin scan is a good start.
- 3
Close the way in
Update your platform, theme and plugins, delete ones you don't use, remove unknown admin users and change every password. Google says running an exploited, out-of-date platform counts as compromised in itself.
- 4
Ask Google to review
If Search Console listed security issues, request a review there so the Safe Browsing warning is removed. In Google Ads, appeal the ads and choose 'Made changes to comply with policy'. Google says to allow up to 72 hours for its recrawl.
Certanza's scan looks for hidden spam links, hidden third-party frames, scrambled code, scripted or automatic redirects to other sites and code that treats Google's crawler differently. It reads the pages a visitor sees, so it can't replace a full server security scan.
Common questions
- Google Ads: Compromised sites
- Google Merchant Center: Abuse of the network
- Google Ads: Abusing the ad network
Certanza is independent and not affiliated with Google. This guide is general information, not legal advice, and Google's policies can change.