Google Ads Suspended for Malicious Software: What to Do Now

When Google Ads suspends your account, all of your ads stop running at once. You usually see a red banner or notice at the top of your account explaining that the account was suspended and naming the policy involved. In this case, that policy is about malicious software: Google believes your site, or something linked from your ads, may harm visitors' devices or data.

This is different from an ad disapproval. A disapproval blocks individual ads that point to a flagged page, while the rest of the account keeps working. A suspension affects the account itself. If only some ads show a "Malicious software" or "Compromised site" label and the account is still active, the section on disapprovals below explains what to do. If the suspension notice mentions phishing rather than malware, our article on a Google Ads account suspended for phishing covers that case.

Google treats malicious software as a serious violation because it puts users at direct risk. For that reason, it can suspend an account without first sending a warning, even if you have advertised for years with no problems.

Google uses two labels for disapproved ads. Malicious software means the landing page, or something it loads, installs or links to harmful software. Compromised site means Google believes someone has changed your site without your permission, often in ways that only show to visitors who arrive from an ad or on a phone, so you may not see anything wrong when you visit yourself.

Common examples of a compromised site:

• Scripts injected into your pages, theme or plugins that load code from another domain.
• A changed .htaccess file that redirects ad or mobile visitors to another site.
• A hacked third-party script, such as a chat widget or analytics tag.
• Spam or doorway pages added to folders you do not use.
• New admin users or hidden backdoor files that let the attacker return.

Check your Google Tag Manager container as well, including paused and old tags. A tag added by someone who no longer works with you, or a tag that loads a hijacked script, is enough to trigger a Compromised site disapproval.

In most cases, the trigger is something on the domain your ads send people to. Google checks landing pages with its own systems, including Google Safe Browsing, the service that powers the red warning pages in Chrome. If your domain is listed there for malware or unwanted software, your ads account can be affected too.

• A hacked website. Attackers often add hidden code that redirects some visitors to harmful pages or downloads, and the owner may not notice.
• A compromised plugin, theme or third-party script. A chat widget, tracking tag or old plugin that was hijacked can load harmful code on every page.
• Downloads on your site. Software, browser extensions or files that Google considers harmful or unwanted.
• Redirects you did not set up. Tracking links, link shorteners or old domains that now lead somewhere unsafe.
• A false positive. Sometimes a clean site is flagged by mistake, for example after a past infection that was already removed.

Before you change anything, find out what Google and other security vendors actually see. Guessing wastes time and can lead to an appeal that misses the real problem.

Start by checking your domain with our free Domain Blacklist Checker. It shows whether Google Safe Browsing, VirusTotal's engines, Spamhaus DBL or URIBL list your domain. Then open Google Search Console, Google's free dashboard for site owners, and look at the Security Issues report. If Google found malware or hacked content, it usually lists the issue type and some example URLs there.

• Read the full suspension notice in Google Ads and note the exact policy name and date.
• Check every domain used in your ads, including final URLs, tracking templates and any redirect domains.
• Look at your landing pages on a phone and in a private browser window, since some hacks only show to new or mobile visitors.
• To check whether a compromise is still live, open your landing page from a phone on mobile data in a private window, then compare your site files with a clean backup to spot anything that was added or changed.

If no vendor lists your domain and Search Console shows no security issues, the cause may be something else in the account, such as a linked app or a download offered in an ad. Note this down for your appeal.

The order matters. Google expects the problem to be gone before it looks at your appeal, so work through these steps one at a time.

1. 1Ask your developer, host or a site cleanup specialist to remove any malicious code, hidden files, unknown admin users and suspicious redirects.
2. 2Update your CMS, plugins and themes, delete the ones you do not use and replace any third-party script you cannot fully trust.
3. 3Change every password (hosting, FTP, database, CMS and Google accounts) and turn on two-factor authentication.
4. 4Request a review in the Security Issues report in Search Console, describing what was found and what was fixed.
5. 5Clear any other security vendor listings on the domain, such as antivirus or web filter flags, so your landing pages load cleanly for everyone.
6. 6Check the domain again with the free checker and confirm it is clean everywhere.
7. 7Only then submit your appeal through the suspension notice in your Google Ads account.

If your account is active but ads are disapproved, the order is the same as for a suspension, just shorter. First clear any security issue in Google Search Console and wait for the review to pass. Then, in Google Ads, appeal the disapproved ads and choose the option that says you made changes to comply with the policy. Appealing before Search Console is clean usually leads to the same disapproval.

It is tempting to appeal the moment the account stops. But if Google reviews your site while the malware or the Safe Browsing listing is still there, the appeal will almost certainly be rejected.

A rejected appeal does not just cost you time. Google may limit how often you can appeal, and repeated unsuccessful appeals can make it harder to get further reviews. Treat your appeal as something you may only get a few chances at, and make the first one count.

Also avoid opening a new Google Ads account to get around the suspension. Google generally treats this as trying to bypass its policies, and the new account may be suspended as well.

A clear, short appeal with facts is more useful than a long emotional message. Gather these before you start:

• The date of the suspension and the policy named in the notice.
• A plain description of what was wrong, for example "an outdated plugin was hacked and added a redirect script".
• What was done to fix it, who did it and when, such as a cleanup report from your host or developer.
• Confirmation that the Search Console security review passed, or that no security issue was listed.
• Screenshots or results showing the domain is no longer listed by Google Safe Browsing or other vendors.
• Steps you took to prevent it happening again, like updates, password changes and two-factor authentication.

Keep a simple timeline in one document. It helps with the appeal and with any follow-up questions from Google.

There is no fixed timeline, and each step is controlled by a different party. A Safe Browsing review in Search Console often takes from about a day to several days for malware issues, though it can take longer. Other security vendors set their own review times, which can range from hours to a couple of weeks.

Google Ads appeal reviews also vary. Some are answered within a few days, others take longer, especially if Google asks for more information. Building in time for the security listings to clear first usually saves time overall, because it lowers the risk of a rejected appeal.

We focus on one part of the problem: the security listings that make Google and other vendors treat your domain as dangerous. Our team reviews each listing, prepares the evidence, submits the removal request through each vendor's official channel (including Google Safe Browsing) and follows up until the vendor responds. You get a confirmation when a listing is removed.

We do not clean malware or repair hacked sites. If your domain really is serving harmful code, we tell you what needs fixing based on what the vendor and scans show, and we wait until it is resolved before submitting a removal request. We also do not manage ad accounts and cannot appeal a Google Ads suspension on your behalf or overturn Google's decision. Once the listings are cleared, you submit the appeal yourself.

Our terms are no cure, no pay. A one-time case costs €39, paid when you open it, and is refunded in full if the vendor refuses to remove the flag. On subscription plans, a case credit is only used when removal is confirmed. If the same vendor re-flags the domain within 30 days and nothing changed on your side, we resubmit at no extra charge. This guarantee does not apply if the listing was justified, if requested information was not provided or if you withdrew the case. We cannot guarantee that a vendor will remove a flag, or how fast.

If you have one domain, a clear Search Console report and a developer who knows the site, you can handle the cleanup and the Safe Browsing review yourself. The harder part is often the other vendors, each with its own process and evidence requirements.

If several vendors list your domain, or you are not sure the listing is correct, getting help can reduce the chance of a failed appeal. After you are back online, daily monitoring can alert you if your domain is flagged again, so you can act before your ads are affected.

To stay clean afterwards, review your tag manager tags every few months, keep recent backups you can restore from, and remove scripts and plugins you no longer use. If the infection keeps returning, read why WordPress malware keeps coming back, and our blacklisted website playbook covers the full recovery.