What Google Means by Malicious Software
Google defines malicious software, or malware, as any software that aims to harm or gain unauthorized access to a computer, device, or network. The policy prohibits the intentional distribution of malware through your ads or through any software your site or app hosts or links to, regardless of whether you promote that software through Google's advertising network.
The scope is broader than most advertisers expect. Google does not only check the ad itself. It scans your landing page, every script your page loads, every redirect in the chain, every iframe, and every third-party resource your site calls. A piece of malicious code buried three layers deep in a script you never wrote can pull the flag on your account.
Why Google Treats It as Egregious
Malicious software is one of the violations Google classes as egregious. That classification means suspension on detection, no warning, no strike system, and a statement that the advertiser will not be allowed to advertise again. Google draws this line because malware poses direct, immediate harm to users: stolen data, hijacked devices, and unauthorized access to networks.
The severity makes sense from Google's side, but it lands hard on advertisers who did nothing intentional. A legitimate store with a hacked plugin gets the same egregious label as a deliberate malware distributor, because Google judges the risk to the user rather than the intent of the advertiser. The user clicking the ad faces the same danger either way.
The Three Policies It Now Covers
Google used to run a single policy called Malicious or Unwanted Software. It has since split that into three separate policies, each with its own severity level and enforcement rules. Knowing which one your suspension falls under tells you how serious it is and how much time you have.
1. Malicious Software
Covers the intentional distribution of malware: software designed to steal data, damage devices, or gain unauthorized access. Immediate suspension with no warning. Google reserves it for cases it considers deliberate or where the risk to users is severe.
2. Compromised Sites
Covers websites whose code has been manipulated by a third party, typically through hacking, without the site owner's knowledge. The hacker injects scripts, redirects, or downloads that harm visitors. You receive a warning at least seven days before any suspension. Our guide on how to Resolve Google Ads Compromised Site Policy covers the specific steps Google expects.
3. Unwanted Software
Covers software that behaves deceptively or unexpectedly: bundling additional programs without clear consent, making itself difficult to uninstall, collecting data without disclosure, or misleading users about what it does. Google issues a warning at least seven days before suspending.
How Innocent Advertisers Get Flagged
Most advertisers suspended under this policy never installed malware on purpose. The flag traces back to something that went wrong on their site, often without them knowing. The most common triggers look nothing like deliberate malware distribution.
- A hacked or outdated plugin: A WordPress plugin, a theme, or a CMS extension with a known vulnerability gets exploited, and the attacker injects a script that redirects visitors or downloads files without consent.
- A compromised third-party script: Your landing page loads a script from a third-party ad network, analytics provider, or widget that has been compromised. The malicious code runs on your page, but it belongs to someone else's server.
- A hidden redirect: Your site has been hacked, and the attacker added a hidden redirect that sends Google's crawler, or your visitors, to a malicious page. The redirect may fire only under certain conditions, such as when the visitor comes from a search engine, which means you never see it in normal browsing.
- Deceptive download behavior: A deceptive download button, a forced file download, or an installer that bundles extra software without clear consent can trigger the unwanted software policy even when the core product is legitimate.
- A misleading ad overlay: Even a legitimate pop-up or overlay that mimics a system warning or a fake virus alert, often injected by a rogue ad network, reads as malicious to Google's scanner.
In every one of these cases, the advertiser is the victim rather than the attacker. Google suspends because the user who clicks the ad faces real risk, and it cannot distinguish intent from effect at the speed it needs to protect people.
How Google Detects It
Google scans your ads and destinations using a combination of automated systems and human review. Its crawler follows the full chain from ad click to landing page, loading every script, tracking every redirect, and checking every resource the page calls. It also draws on third-party sources, including Google Safe Browsing, which maintains a global list of sites known to distribute malware or host phishing.
The detection reaches beyond your own code. If your page loads a JavaScript file from a CDN that has been compromised, Google flags your page, not the CDN. If a redirect in your tracking template passes through a domain that Safe Browsing has listed, your ad fails even when your own site is clean. Google judges the entire path from click to landing, and a weakness anywhere in that path triggers the violation.
Suspended for Malicious Software?
Google names the policy but rarely identifies the infected file. Send us your suspension notice and your site URL, and within 48 hours you get a written diagnosis identifying the specific trigger and whether the case has a real path to reinstatement.
What Happens When You Get Flagged
The outcome depends on which of the three policies you land under. A malicious software flag (egregious) suspends your account immediately, stops all ads, and drops the account into read-only mode. A compromised site or unwanted software flag sends a warning first, and you get at least seven days to fix the issue before any suspension takes effect.
In all three cases, Google names the policy in the suspension or warning notice and emails it to the address on file. The notice tells you which policy triggered the flag, though it rarely identifies the specific file or script that caused it. That diagnosis falls on you, and it is where most of the work in recovery lives.
How to Clean Up and Recover
Recovery starts with cleaning the site, not with filing an appeal. Google checks actual compliance, so an appeal submitted while the malware still sits on the page will fail. Work through these steps in order.
- Scan the site for malware. Use a reputable malware scanner such as Sucuri SiteCheck, Wordfence, MalCure, or Google's own Safe Browsing diagnostic. Run the scan on your landing page, your homepage, and any page your ads link to.
- Remove the malicious code. Delete or replace every infected file the scanner finds. Update your CMS, plugins, and themes to their latest versions. Change your admin passwords and remove any users you do not recognize.
- Audit third-party scripts. Open your page in a browser's developer tools and review every external script, iframe, and resource it loads. If any of them point to a domain you do not recognize or that Safe Browsing flags, remove them.
- Check the redirect chain. Walk the full path from your ad's tracking template through every redirect to the final landing page. Confirm every hop lands on a page you control and trust.
- Verify the fix. Run the malware scanner again after the cleanup to confirm the site is clean. Check Google's Safe Browsing status for your domain. Save the results as evidence for your appeal.
- Appeal with evidence. Describe what you found, what you removed, and what you changed. Attach the clean scan results. Complete advertiser verification if Google asks, and submit one careful appeal rather than several rushed ones.
For a detailed walkthrough of the full recovery path, our guide on how to Resolve Google Ads Malicious Software Policy covers every step, including how to handle the egregious classification and what evidence Google expects. If you need hands-on help diagnosing the infection or preparing the appeal, contact our technical team for a walkthrough.
How to Prevent It From Happening Again
Cleaning up once is not enough if the same vulnerability lets an attacker back in. Build a few habits that keep the flag from returning.
- Update everything: Keep your CMS, plugins, and themes updated. Most hacks exploit known vulnerabilities in outdated software, and a single unpatched plugin can open the door.
- Use a security plugin or WAF: Install a web application firewall that blocks common attack patterns before they reach your site.
- Audit third-party code: Review every external script, ad network tag, and analytics snippet your pages load. Remove anything you do not actively use, and verify that the sources you keep are trustworthy.
- Set up uptime and malware monitoring: Use a service that checks your site daily and alerts you the moment it detects an issue, so you catch a compromise before Google does.
- Lock down access: Strong passwords, two-factor authentication on your CMS admin, and a tight list of users with access to your hosting and CMS all reduce the chance of unauthorized changes.
A site that stays patched, monitored, and lean on third-party code rarely meets this flag. The advertisers who get caught are almost always the ones running outdated software with no monitoring, and by the time they find out, Google has already found it first.
Malicious Software vs. Compromised Sites vs. Unwanted Software
Knowing which bucket your violation falls into matters, because the severity and the recovery path differ. Malicious software is egregious: immediate suspension, no warning, and reinstatement only in compelling circumstances. It covers intentional malware distribution. Compromised sites and unwanted software are not egregious: you get a warning and at least seven days before any suspension, which gives you a window to fix the problem while your ads still run.
| Policy | Severity | Warning Period | What It Covers |
|---|---|---|---|
| Malicious Software | Egregious | None | Intentional malware distribution |
| Compromised Sites | Standard | 7+ days | Hacked sites with injected code |
| Unwanted Software | Standard | 7+ days | Deceptive or unexpected software behavior |
In practice, the boundaries blur. A hacked site can be flagged under compromised sites or under malicious software, depending on what Google's scanner finds and how severe it judges the risk. If the injected code steals payment data, Google may treat it as malicious software even though the site owner is the victim. Read the specific policy named in your notice carefully, because that name determines whether you have a warning window or an immediate suspension.
The Bottom Line
A malicious software violation does not mean you are a criminal. It means Google found something harmful in the chain between your ad and your landing page, and it pulled your ads to protect the people clicking them. The cause is almost always a hacked page, a bad plugin, a compromised script, or software that behaves in ways users did not agree to.
Find the infection, clean it thoroughly, prove the site is safe, and appeal with evidence. Most advertisers who follow that path get their accounts back, and the ones who build monitoring and update habits afterward never see the flag again.