Your ads stopped serving, and the reason in your account reads “Compromised site” or “Malicious or unwanted software.” If you’re spending on Google Ads, this is a special kind of stomach-drop — the traffic you pay for shuts off instantly, and every day disapproved is a day of leads or sales you’re not getting. Take a breath. This is a known, fixable situation. This guide explains what those disapprovals mean, what triggers them, how to clean the site behind them, and how to get your ads re-reviewed and running again.
What the disapproval is telling you
Google Ads won’t send paid traffic to a page it thinks will harm the person who clicks. When Google’s systems detect that your landing page — or any page on the same site — is serving malware, unwanted software, or deceptive content, it disapproves the affected ads under a policy usually labeled “Compromised site” or “Malicious or unwanted software.” The ads don’t run until the site is cleaned and re-reviewed.
The important thing to understand: this is almost never a mistake or a wording problem in your ad. It’s the same underlying signal that powers Google Safe Browsing — the blocklist behind the red “The site ahead contains malware” browser screen we cover in the site ahead contains malware. If your ads got disapproved for a compromised site, the overwhelmingly likely reality is that the site itself has been hacked, even if it looks perfectly normal when you visit it.
Why it got triggered
A compromised-site disapproval usually traces to one of these:
- Injected malware. An attacker slipped malicious code into your files or database — often a script that redirects visitors, serves a harmful download, or tries to install something on their device.
- Deceptive or phishing content. Hidden fake login or payment pages planted on the site, which Google treats as social engineering.
- A hidden redirect. The page quietly sends some visitors — sometimes only on mobile, or only from ad clicks — to a scam or spam destination. This one is especially common with ad disapprovals because the ad click is exactly the condition the attacker targets.
Because the malicious behavior is often conditional — only certain devices, only certain referrers — you may never trigger it yourself, which is why the disapproval feels like it came out of nowhere. If you want to confirm the signs of a compromise before assuming, we walk through them in how to tell if your WordPress site has been hacked.
How to clean it and get re-reviewed
Work these in order. Requesting a re-review before the site is actually clean just wastes a review cycle and keeps your ads dark longer.
1. Cross-check Google Search Console
Even though the disapproval showed up in Google Ads, open Google Search Console and look at the Security Issues report. It often names the specific problem — malware, deceptive pages, harmful downloads — and lists sample URLs. That’s your map to what to clean. Verify the site in Search Console if it isn’t already.
2. Find and remove the malware
Scan the site, locate the malicious code, and remove it — the hacked WordPress files, injected scripts, rogue admin users, hidden redirects in .htaccess (a server settings file), and anything planted in the database. Attackers rarely leave a single file, and they almost always hide a backdoor so they can return after you clean up. Missing that hidden way back in is how sites get re-disapproved days later. The full cleanup sequence is in how to fix a hacked WordPress site.
3. Close the hole that let them in
Before you ask for a re-review, close the way they got in so it doesn’t recur: update WordPress itself, every plugin, and every theme; delete anything unused; reset all passwords — admin, hosting, database, file access (FTP/SFTP) — and turn on strong login protection. A site that gets re-flagged right after a re-review makes the next approval slower.
4. Request a re-review in Google Ads
Once the site is genuinely clean and up to date, request a review of the disapproved ads through your Google Ads account. Google re-checks the destination and, if the compromise is gone, restores the ads so they can serve again.
The honest part: Google controls the timing of that re-review, and no one can promise a specific turnaround. What you can control is not requesting the review on a site that isn’t fully clean — a failed re-review keeps your ads paused and your spend stalled longer. Clean it once, request the review, and give it time.
How SolutionHippo handles this
We’ll be straight about where we fit. This is the situation our managed hosting is built to keep you out of — which, when you’re paying for every click, is money as much as reputation. Malware scanning is part of the care that’s included with every plan — not an upsell, not a separate retainer — so an injection tends to get caught and removed before it ever trips Google’s systems and freezes your ads. That’s prevention, not a guarantee: our scanning is designed to catch it before it gets that far, backed up well: a strong firewall stops bad traffic early, breached-password login defense keeps stolen logins out, and off-site backups 3 times a day mean even a bad day is just a restore. After any change, we verify the site still looks and works right.
And if your ads are already disapproved? That’s work we do for sites we host, so the offer is simple: move your site to us, and we clean it as part of the move and keep it clean. We’ve cleaned compromised sites, torn out the injected malware and hidden redirects, closed the hole the attacker used, and gotten owners back to a clean site ready to submit for re-review. We won’t promise a re-review deadline we don’t control, but we will do the cleanup right the first time so the review has the best chance of passing on the first try.
Ads disapproved and spend on hold right now? Every day dark costs you. Move your site to us: we clean it as part of the move and keep it clean. Start my move — your move starts as soon as you sign up. We’ll clean the site, close the door behind it, and get you to a clean landing page ready for re-review. Flat pricing at $29.99 a month for a managed site, or starting at $39.99 for a store, with the protection built in — no metering, no surprises.