Fix a Compromised Site: Google Ads Disapproved for Malicious Software

Your Google Ads were disapproved for "Compromised site" or "Malicious software"? Learn what triggers the policy, how to clean your site and how to get ads re-approved quickly.

Google Ads shows "Compromised site" or "Malicious software" next to your ads, and your traffic drops to zero. Google has detected that your landing pages, or something they load, may harm visitors.

This policy is strict, but the path back is clear. Follow these steps in order.

Key takeaways

  • The disapproval applies to every ad that points to the affected domain.
  • It is almost always linked to a Google Safe Browsing detection on your site.
  • Clean the site first, then request a Safe Browsing review in Search Console, then appeal in Google Ads.
  • Appealing in Google Ads before the site is clean only leads to repeated rejections.

What the two disapprovals mean

Google uses two related policy labels:

  1. Compromised site: your site appears to have been hacked, for example with injected scripts, spam pages or redirects added by an attacker.
  2. Malicious software: your site hosts or links to software that harms devices, such as malware downloads or unwanted software.

Both are usually driven by the same Google Safe Browsing data that shows red warnings in Chrome. Check whether visitors also see a warning.

Step 1: Confirm what Google found

Open Google Search Console for your domain and go to Security Issues. You will see the issue type and sample URLs. Also check your domain on VirusTotal to see whether other vendors flag you, and our guide on Google Safe Browsing false positives if you believe the detection is wrong.

Step 2: Find and remove the malicious code

Common sources on ad-driven sites:

  1. Injected JavaScript in the header, footer or tag manager that redirects mobile visitors.
  2. Hacked plugins, themes or CMS extensions.
  3. Compromised third-party scripts, such as chat widgets, ad scripts or tracking pixels.
  4. Hidden files and folders uploaded by an attacker.
  5. Downloadable files that were modified or replaced.

Check your landing pages from a phone and from a clean browser. Many injections only trigger for first-time mobile visitors arriving from Google.

Step 3: Close the hole

Update your CMS, plugins and themes, remove unused ones, change every password (hosting, FTP, database, CMS admins) and enable two-factor authentication. Without this, reinfection within days is common. Our article on WordPress malware that keeps coming back explains why.

Step 4: Request reviews in the right order

First click Request a Review in Search Console and describe the cleanup. Once Google confirms the site is clean, go to Google Ads, open the disapproved ads and choose Appeal with the reason "Made changes to comply with policy". Ads are usually re-approved within one to three working days after the Safe Browsing review passes.

Step 5: Check other vendors

A compromise is rarely seen only by Google. Antivirus and web filter vendors may also have listed your domain, which blocks part of your paid traffic even after ads return. Follow our full blacklist playbook to clear them.

Frequently asked questions

Can I just change the landing page URL?

Only if the new URL is on a different, clean domain. All URLs on the flagged domain stay disapproved.

How long does re-approval take?

Usually one to three working days after the Search Console review passes.

My site was never hacked. What now?

Request a review explaining why the site is clean. Third-party scripts are the most common hidden cause, so check those first.

Will my account be suspended?

Repeated malicious software violations can lead to suspension, so fix the root cause before appealing.