Google Ads Malicious Software Disapproved: What It Means and How to Fix It

Last checked 3 October 2026 against Google's documentation. By Muhammed Abdul Kalam. Blocks some ads

Quick fix

A Google Ads malicious software disapproved status usually means Google found your landing page hacked or serving unsafe code. Filter your ads by the Compromised site policy, remove the injected code, update your CMS and plugins, check Safe Browsing, then resubmit the ads for review.

Filter your ads by Policy Details: Compromised site to see which are affected.
Look at the disapproval reason for the domain the bad code loads from.
Run the Security Issues Report in Search Console.
Check your site in Google's Safe Browsing Site Status Checker.

Can't fix it yourself? Send me the details

What this error means

Your landing page is running code that harms visitors or benefits someone else, usually because the site was hacked. Google disapproves ads pointing to that page. Deliberately distributing malware is treated far more seriously: it suspends the whole account without warning.

Google defines malware as software that aims to harm or get unapproved access to a computer, device or network. The rules cover your ads and any software your site or app hosts or links to.

What Google shows

Compromised site

Why it happens

1Your site has been hacked and injected with code

Someone has added scripts to your site that act without your knowledge: card skimmers, malware installers, pop-up ads or redirects to other websites.

How to tell if this is you: The disapproval reason names a domain you don't recognise, or visitors report pop-ups or redirects you didn't add.

2An outdated CMS, theme or plugin was exploited

A content management system with known security holes that has been exploited counts as a compromised site.

How to tell if this is you: Your CMS, theme or plugins haven't been updated in a while.

3Safe Browsing has flagged your domain

Google has disallowed the site in Safe Browsing because of unsafe content it may be exposing to users.

How to tell if this is you: Google's Safe Browsing Site Status Checker shows your domain as unsafe.

4Software your site hosts or links to is malware

The policy covers any software your site or app hosts or links to. Intentionally distributing malware is an egregious violation that suspends the account without warning.

How to tell if this is you: Your account is suspended, not just your ads disapproved, and the notice names Malicious software.

How to fix it

Find the affected ads

Open your ads.Campaigns then Ads
Filter by Policy Details: Compromised site.
Read the disapproval reason. Google Ads sometimes shows the domains the bad code comes from.

Clean the site

For: Your site has been hacked and injected with code, An outdated CMS, theme or plugin was exploited

Remove any code that refers to the domains Google identified.
Run the Security Issues Report in Google Search Console to find malicious software and other security issues.
Update your content management system, themes and plugins to the latest versions.
Ask your web developer or a security specialist for a full security assessment.

Get off the Safe Browsing list

For: Safe Browsing has flagged your domain

Check the site in Google's Safe Browsing Site Status Checker.
Fix the malware, then appeal in Google Search Console so the domain is taken off the Safe Browsing threat list.
Your landing pages should be re-enabled for ads automatically. If the ads are still disapproved, contact Google Ads support.

Get the ads reviewed

If you can't fix the page, edit the ad to point at a new destination. Editing resubmits the ad and its destination for review.
If you only changed the landing page, appeal the ads with Made changes to comply with policy.

How to appeal or request a review

Appeal once you've cleaned the site, or if you believe the ad was flagged by mistake.

In the Status column of the ad, hover over the status and click Appeal.
For Reason for appealing, pick Dispute decision or Made changes to comply with policy.
Under Appeal the following, choose the ads to appeal, then select Submit.
Track the result in Policy manager.

What to include

Use Made changes to comply with policy if you changed only the landing page.

What not to do

Don't keep resubmitting an appeal that failed. Make a small edit to the ad text or final URL and save it, which forces a new crawl.
Don't appeal the same ads again within 24 hours, or the appeals are marked as duplicates.

Open Google's review page

How long it takes

After you clean the site and resubmit, allow up to 72 hours for Google to recrawl and re-evaluate the landing page.

How to stop it happening again

Keep your CMS, themes and plugins on their latest versions.
Set up Search Console so you can run the Security Issues Report on your site.
Check your domain in Google's Safe Browsing Site Status Checker if you notice anything odd.
Fix compromised-site disapprovals quickly. They don't suspend accounts without warning, but a warning comes at least 7 days before any suspension.

From my desk

Outdated plugins and themes and weak admin passwords are common ways sites get compromised, but the host can confirm the real cause. I tell the client to clean the site, update everything, change all passwords, and request a review in Google Ads once the issue is gone.

Muhammed Abdul Kalam

When to get help

You have cleaned the site but the disapproval or Safe Browsing warning keeps coming back.
You don't know how the code got in, so you can't be sure it's gone.
Your whole account has been suspended rather than individual ads disapproved.

Stuck on this? Send me the details.Tell me what the platform shows and what you've tried so far.

Send me the details

FAQs

Why are my Google Ads disapproved for malicious software when I never added any?

Usually because the site was compromised: someone changed its code without your knowledge, for example to add card skimmers, pop-ups or redirects. Outdated content management systems with known security holes are a common way in.

What does "Compromised site" mean in Google Ads?

It's a site whose code has been manipulated to benefit a third party without the owner's knowledge. Ads pointing to it are disapproved until the site is fixed.

How long after cleaning my site will my ads run again?

Google says to allow up to 72 hours for the system to recrawl and re-evaluate the landing page after you resubmit. If Safe Browsing flagged the domain, you also need to appeal through Search Console.

Will a malicious software violation suspend my Google Ads account?

A compromised site gets a warning at least 7 days before any suspension. Intentionally distributing malware is egregious: the account is suspended on detection without warning, and you can't advertise with Google Ads again.

How do I get my site off the Safe Browsing list?

Fix the malware, then appeal in Google Search Console so the domain is taken off the Safe Browsing threat list. Your landing pages should then be re-enabled for ads automatically.