Why it happens
The site was hacked
The site was hacked
Injected code pushes malware or drive-by downloads. Usually through an outdated CMS or plugin.
Your own download is flagged
An installer that bundles extra software, changes browser settings or does not disclose what it installs reads as unwanted software.
A third-party file or ad network on the page
An ad network, file host or script you embed serves something Google flags.
How to fix it, step by step
Find what was flagged
In Google Search Console, open Security and manual actions, then Security issues, and read the issue type and sample URLs.
Remove the malware or the bundle
Clean the site, or rebuild the installer so it installs only what it says, discloses changes and uninstalls cleanly.
Request a review
On the Security issues report, select Request review and explain what changed.
Appeal in Google Ads
Go to Tools, then Troubleshooting, then Policy manager, select Appeal on the Malicious software issues and choose Made changes to comply with policy.
Steps checked against Google Ads Advertising Policies Help: Malicious software; Google Search Console Help: Security issues report; Google Ads Advertising Policies Help: Fix a disapproved ad or appeal a policy decision.
Sprites diagnoses this
Sprites diagnoses it
Sprites shows every ad and URL the malware flag took down, so you know the full blast radius.
What Sprites does
- Reads the approval status and policy topics on every ad and lists each one flagged Malicious software.
- Lists the final URLs those ads point to.
- Pauses ads that point at the flagged pages, once you approve, so nothing tries to serve against them.
What it doesn't do
- It does not scan, clean or host your site or your downloads.
- It does not request the Search Console review or file the appeal.
Questions
What counts as malicious software in Google Ads?
Malware that harms devices, plus unwanted software: installers that bundle extras, change settings without clear consent or are hard to remove.
Can a malicious software flag suspend my account?
Yes, Google treats it as serious. Promoting malware knowingly can suspend the account, so clean the site before anything else.
My site is clean now. Why are the ads still disapproved?
Google has not rechecked yet. Request a review in Search Console, wait for it to clear, then appeal the disapprovals.
Is it safe to point ads at a different domain meanwhile?
Only if that domain is clean and the ad matches it. A new domain also has to pass the destination mismatch rules.
See where it breaks
Connect your accounts. Sprites reads them side by side and shows you exactly where the numbers split.