If you are a marketing agency (or a business owner) and suddenly multiple client accounts start getting hit with Google Ads policy issues like “Compromised Site”, I feel your pain. It’s one of those errors that can destroy delivery, kill trust with clients, and waste weeks—because even after a suspension is removed, sometimes the account still sits at 0 impressions / 0 clicks.
In this article, I’ll break down:
- What “Compromised Site” actually means (and why Google flags clean sites)
- Why impressions can remain blocked even after reinstatement
- A practical checklist to clean, verify, document, and recover
- What to send to Google support (so you stop getting generic rejections)
- Prevention steps to protect an agency managing multiple accounts
Google’s own policy guidance for compromised sites strongly points to malware/security remediation and Safe Browsing / Search Console review as a core requirement for re-enabling ad serving.
What is “Compromised Site” in Google Ads?
“Compromised site” is basically Google saying:
Your landing page (or domain) appears unsafe for users.
It can be malware, unwanted software, redirects, injected scripts, hacked files, or suspicious behavior on the landing page.
The tricky part is: you can scan the site and still find “nothing,” but Google may still detect:
- conditional redirects (only show to specific user agents)
- injected scripts that appear only on certain pages
- third-party tags that load suspicious resources
- hosting/IP issues affecting trust signals
Common Reasons You Get Flagged (Agency Reality Check)
From what we see most often (especially with WordPress):
- Malware / injected JS/PHP (sometimes hidden, sometimes conditional)
- Nulled plugins/themes (very common root cause)
- Adware behavior (popups, forced redirects, fake buttons)
- Hacked admin access (stolen credentials, leaked FTP keys)
- Suspicious third-party scripts (tracking, chat widgets, CDNs)
- Hosting/IP reputation problems (bad neighbors on shared hosting)
- Domain-level reputation (previous abuse history)
- Search Console security warnings (even if site “looks normal”)
Why Impressions Stay at 0 After the Suspension is Removed
This is the part agencies hate.
Here are the most common reasons I’ve seen when the UI shows “eligible/approved” but traffic is dead:
1) Domain is still flagged deeper in Google systems
Even if your Google Ads account looks “clean,” the domain/URL can remain restricted until security systems fully clear it. Google’s compromised-site policy mentions Safe Browsing and Search Console review flows, and notes that once you complete the process successfully, your landing pages should be re-enabled to serve ads.
2) You fixed the site—but didn’t complete the verification loop
Many people clean the website and immediately appeal in Google Ads.
But the right order in most cases is:
- clean
- secure
- verify in Search Console
- request review / ensure Safe Browsing is cleared
- then appeal in Ads with proof
3) “Learning / re-trust” period + quality signals dropped
A compromised-site incident can hammer trust signals. If the account is newer, or if many ads/URLs were disapproved, delivery can be slow to recover.
4) Campaign-level reasons (not policy) are now blocking delivery
Sometimes the policy issue was the “headline,” but once it’s removed, your campaigns still won’t serve because of settings. Google provides a troubleshooting doc for “low traffic / not serving” that includes account issues, policy status, start dates, budgets, targeting, and more.
5) System lag / stuck review states
Yes, it happens. And in practice, editing/rebuilding ads can “refresh” the pipeline.
Step-by-Step Recovery Checklist (Use This in Real Life)
Step 1: Confirm if the domain is still flagged
Do these checks:
- Google Search Console → Security Issues
- Google Safe Browsing / Transparency status
- Server logs for unexpected bots, POST requests, file changes
If Search Console shows issues, fix them first and request a review. Google’s own policy guidance specifically calls out completing remediation and filing the right review/appeal process so the domain can be re-enabled.
Step 2: Do a “real” malware scan (not just one plugin scan)
For agencies, do it like a forensic checklist:
- run an external scanner + server-level scan
- check recently modified files
- compare core CMS files with clean originals
- scan database for injected scripts
- inspect redirects, .htaccess rules, wp-config, header/footer templates
- review third-party scripts (tag manager, chat widgets, heatmaps)
(If you are on WordPress: remove nulled themes/plugins immediately. Reinstall clean versions.)
Step 3: Lock the site down (or Google will re-flag you)
- reset all admin passwords
- rotate FTP/SFTP keys
- update plugins/themes/core
- enable WAF / firewall (Cloudflare + security plugin)
- force 2FA for admin users
- remove unused plugins/themes
- verify SSL and mixed content issues
Step 4: Build your “evidence pack” (this is what most people skip)
When you contact Google support or re-appeal, don’t send “we scanned and it’s fine.”
Send a clean, structured proof bundle:
- Search Console screenshot showing no security issues
- Safe Browsing status (or proof it is cleared)
- list of changes made (patches, plugin removals, file cleanups)
- confirmation from hosting provider about server-level scan
- date/time of remediation
- if possible: before/after file integrity summary
This type of structured documentation tends to outperform generic appeals (even in community experiences).
Step 5: In Google Ads, force a clean “re-serve” action
If suspension is removed but you’re stuck:
✅ Do this in order:
- Duplicate the ads (or create fresh ads)
- Edit and resubmit (small changes can trigger a re-check)
- Switch bidding to Maximize Clicks for a short period
- Confirm budget isn’t limiting and your keywords aren’t “low search volume”
- Check location targeting, schedules, and audience restrictions
- Review Policy Manager for any hidden/lingering disapprovals
- Use Google’s “ads not serving / low traffic” troubleshooting flow
This is the fastest practical path I’ve used to restart delivery after a policy incident.
Step 6: Escalation (when support replies are generic)
If you’re still stuck after all of the above:
- open a new support case with your evidence pack
- keep it factual, short, and structured
- reference that the site is clean + Search Console security review is clear
- request confirmation whether the domain is still flagged at a deeper level
If you are a Google Partner agency, use your Partner channels and provide the same documentation.
Agency Prevention: How to Stop “Compromised Site” From Hitting Many Accounts Again
If many accounts got hit around the same time, think like an investigator:
- Are multiple sites on the same hosting / IP range?
- Are you using the same WordPress theme bundle across clients?
- Is there a shared plugin (often the real culprit)?
- Is there a shared Tag Manager container template?
- Are you deploying the same chat widget/tracking script everywhere?
Standardize:
- clean hosting
- licensed plugins/themes
- firewall + backups
- monthly security audit
- least-privilege user access
Frequently Asked Questions
1) “My site is clean, why did Google flag it?”
Because Google flags behavior patterns too—redirects, scripts, third-party resources, hosting reputation, and historical domain trust can all contribute.
2) “Suspension is removed but impressions are still 0—does that mean I’m still blocked?”
Not always, but it’s possible. First confirm Search Console / Safe Browsing status, then troubleshoot campaign-level delivery issues using Google’s checklist.
3) “What’s the fastest fix?”
If the site is truly clean: rebuild/duplicate ads + temporary Maximize Clicks + submit a well-documented evidence pack to support.
Need Help From My Team?
If you’re stuck in Google Ads disapprovals, Google Ads suspensions, compromised site issues, or Google Business Profile suspensions, my team handles these cases daily.
We are a Google Partner company and can investigate both:
- website security + domain reputation
- Google Ads policy + delivery troubleshooting
![Compromised Site in Google Ads: Root Cause, Cleanup, and Reapproval [Shopify + Wordpress]](https://aliraza.co/wp-content/uploads/2026/02/Compromised-Site-Shopify-Wordpress-google-ads-disapproval-350x195.jpg)
