Conditional redirects
Injected code that redirects visitors arriving from ads or search, or on mobile, to scam or malware pages — while the owner, typing the address, sees the normal site.
Guide · Google Ads policy
Google Ads stopped your ads because the site is compromised. Fix the site before you appeal.
Your ads show as disapproved for a compromised site or for malicious or unwanted software, or the whole Google Ads account has been suspended. Either way, the cause is on the website the ads point to, not in the ads. An appeal is judged against the site as Google finds it when it checks again, so the work is a real cleanup first, then a set of external checks, then a single appeal.
Published Last reviewed
- What triggered it
- Google’s checks found the landing pages compromised or serving harmful software
- Scope
- Individual ads can be disapproved; repeated or serious cases can affect the whole account
- Shared signals
- Google Ads and Google Safe Browsing both judge whether a site is harmful
- The fix
- A verified cleanup, clean external checks, then one appeal
What happened
A disapproval and a suspension are different problems
A disapproval applies to individual ads, or to the ads pointing at a particular destination. The account keeps running; those ads simply stop serving until the destination passes Google’s review again. Policy manager in the account shows which ads are affected and the policy involved.
A suspension applies to the whole account: nothing serves. Google can suspend an account for serious or repeated policy problems, and malicious or compromised destinations are among the issues it treats seriously. The notice explains the reason and links to the route for appealing it.
In both cases the cause is the same: when Google checked the landing pages, it found them compromised or serving something harmful to users. Until that is no longer true, editing the ads or appealing changes nothing.
Why the site was flagged
What Google’s ad checks see that you do not
Google checks ad destinations with its own crawlers and with the same Safe Browsing data that powers browser warnings. A compromise that hides from the site owner is often exactly what those checks catch.
Injected scripts and overlays
A script in the theme, the database or a drop-in that loads a fake prompt, a fake download, or a fake verification step on top of the landing page.
Malicious files on the domain
Installers, phishing kits or spam pages planted elsewhere on the same domain can affect how Google judges every destination on it.
Third-party scripts and tracking templates
A compromised widget, chat or analytics script, or a tracking redirect that now points somewhere harmful, makes the landing page harmful even if your own files are clean.
Clean it
Clean the site as an incident, not as an ads problem
- 01
Preserve before changing anything
Copy suspicious files, export the database and keep the access logs. If the site was redirecting ad clicks, the logs show when it started and what visitors were sent to.
- 02
Remove every persistence layer
Injected code in files and the database, rewrite rules, drop-ins and mu-plugins, scheduled tasks, startup directives and rogue administrator accounts. Removing only the redirect leaves the code that will put it back.
- 03
Close the entry path and rotate access
Update or remove the vulnerable component and change control-panel, SFTP, database and WordPress credentials from a clean device.
- 04
Review every third-party script on the landing pages
Remove anything you do not recognise or no longer use, and check that tracking templates and final URLs point where you expect.
Before you appeal
The pre-appeal checklist
Each of these is something Google can see. Appeal only when all of them are clean.
Figure 1 · Before you appeal
Appeal once, after every check is clean — not repeatedly while you clean.
The order that works
- Clean the siteEvery layer, entry closed
- Safe Browsing cleanTransparency Report status
- Search Console clearNo open security issues
- Appeal onceIn Policy manager
What makes it worse
- Resubmitting adsBefore the site is clean
- Editing to force reviewSame destination, same result
- A new accountCan count as circumvention
- 01
Check the landing pages as Google’s ad crawler
Fetch each final URL with the ad crawler’s user agent and compare it with a normal request; a different response means the site still treats Google differently:
curl -sL -A 'AdsBot-Google (+http://www.google.com/adsbot.html)' https://example.com/landing-page/ | sha256sum curl -sL -A 'Mozilla/5.0 (Linux; Android 14; Pixel 8)' https://example.com/landing-page/ | sha256sumMatching hashes are a good sign, not proof: some cloaking keys on Google’s IP addresses rather than on the user agent. Pages with dynamic content can also differ harmlessly, so read both responses if they do not match.
- 02
Confirm the Safe Browsing status
Google’s Transparency Report has a site status lookup that shows whether Safe Browsing currently considers the domain unsafe. If it does, that has to clear first — through a review in Search Console.
- 03
Clear Search Console security issues
Open the Security Issues report for the domain. Any open issue — hacked content, malware, deceptive pages, harmful downloads — needs a successful review before an Ads appeal is likely to succeed.
- 04
Test as a visitor from an ad would arrive
Open the final URLs in a private window on a phone, with the tracking parameters your ads use. Conditional redirects often key on exactly those conditions.
- 05
Appeal once, with a plain account of the cleanup
Use the appeal route in Policy manager for disapproved ads, or the one linked from the suspension notice for an account. Say what was found, what was removed, how the entry path was closed, and that the site has been verified clean.
What not to do
Moves that tend to make it last longer
- Resubmitting or duplicating the disapproved ads before the site is clean — they are judged against the same destination.
- Editing ads just to trigger another review without changing anything on the site.
- Pointing the ads at a different page on the same compromised domain, or at a fresh domain that redirects to it.
- Opening a second Google Ads account while one is suspended.
- Appealing with a statement that the site was never compromised when the cleanup found that it was.
Common questions
Common questions about compromised-site disapprovals
My site works fine for me. Why does Google Ads say it is compromised?
Because the harmful behaviour is usually conditional: it targets visitors arriving from ads or search, or on mobile, and skips the logged-in owner. Google’s checks arrive the way a visitor does. Test from a private window on a phone with your ad’s tracking parameters, and use Search Console’s URL Inspection.
Do I need to fix Search Console and Safe Browsing before appealing?
If either shows a problem, yes. Google Ads and Safe Browsing both assess whether the site is harmful, and an open Safe Browsing flag or Search Console security issue is a strong sign the appeal will be refused.
How long does an appeal take?
Google does not publish a fixed time, and it varies. The factor you control is whether the site is genuinely clean, and checked, when the appeal is sent.
Can I keep advertising with a new account while I fix this?
Not safely. Google can treat a new account opened to keep advertising during a suspension as circumventing its enforcement, which is much harder to resolve. Fix the site and appeal from the existing account.
The ads were disapproved but the account is fine. Is it urgent?
Yes. A disapproval means Google found the destination harmful; visitors reaching the site some other way are exposed to the same thing, and repeated policy problems can escalate to the account.