Why it happens
An outdated CMS, theme or plugin was exploited
An outdated CMS, theme or plugin was exploited
The most common route in. A known WordPress plugin vulnerability lets an attacker inject scripts or redirects.
A third-party script was hijacked
A chat widget, analytics tag or CDN library you load from someone else was altered and now ships malicious code.
A skimmer on checkout
Code that sends card or form data to a third party, often only on checkout pages, so the home page looks clean.
Leftover infection after a cleanup
A backdoor file or a rogue admin user survived an earlier cleanup and re-infected the site.
How to fix it, step by step
Confirm what Google found
In Google Search Console, open Security and manual actions, then Security issues. It lists the type of infection and sample URLs.
Clean the site
Update the CMS, themes and plugins, remove unknown admin users and files, rotate passwords and keys, and restore from a clean backup if you have one.
Check third-party scripts
Audit every external script on checkout and form pages. Remove anything you do not recognize.
Request a review in Search Console
On the Security issues report, select Request review and describe what you removed. Wait for it to clear.
Appeal in Google Ads
Go to Tools, then Troubleshooting, then Policy manager, select Appeal on the Compromised site issues and choose Made changes to comply with policy.
Steps checked against Google Ads Advertising Policies Help: Compromised sites; Google Search Console Help: Security issues report; Google Ads Advertising Policies Help: Fix a disapproved ad or appeal a policy decision.
Sprites diagnoses this
Sprites diagnoses it
Sprites shows exactly which ads, campaigns and URLs the disapproval took down, and the hour spend stopped.
What Sprites does
- Reads the approval status and policy topics on every ad and lists each one flagged Compromised site.
- Pins down the day and hour spend dropped, so you know how long the account was dark.
- Lists the final URLs behind the affected ads, so you know which pages to clean first.
What it doesn't do
- It does not scan or clean your site, and it does not touch your CMS.
- It does not request the Search Console review or file the appeal.
Questions
Why did Google say my site is compromised when it looks normal?
Injected code often runs only for some visitors, some devices or some pages like checkout, and hides from logged-in admins. Search Console shows the sample URLs Google flagged.
Can I just point my ads at another page on the same site?
No. The flag sits on the domain, so every ad pointing there stays disapproved until the site is cleaned and reviewed.
How long does it take to get ads back after a compromised site?
The Search Console review usually takes from a day to a few days. After it clears, Google Ads re-checks the ads, and an appeal speeds that up.
Is compromised site the same as malicious software?
They are close. Compromised site means a third party altered your site. Malicious software covers any destination that hosts or pushes malware, including software you publish yourself.
Will this suspend my Google Ads account?
A compromised site leads to disapprovals, not an immediate suspension. Leaving it unresolved, or advertising known malware, risks the account.
See where it breaks
Connect your accounts. Sprites reads them side by side and shows you exactly where the numbers split.