Compromised site

A compromised site is a website that has been hacked, infected with malware, contains phishing scripts, or has been altered by unauthorized parties to harm visitors. When Google detects your site is compromised, they immediately suspend your Google Ads account under the malicious software or user safety policies without warning. Common signs include unexpected redirects, code injections, malware downloads, or phishing pages. Even if the compromise was accidental (like a vulnerable WordPress plugin), your account gets suspended instantly to protect users.

To get reinstated, you must completely clean your site, remove all malicious code, fix the security vulnerability, prove your site is safe, and then appeal with timestamped screenshots showing the site is clean.

Example: A business’s WordPress site gets hacked through an outdated plugin, injecting redirect code that sends visitors to a malware site, resulting in immediate Google Ads account suspension for compromised site until they clean the infection and prove it’s resolved.