Prevent malware in ad content (2024)

Google actively works with trusted advertisers and partners to help prevent malware in ads. All publishers and ad networks should follow the security recommendations detailed at https://anti-malvertising.withgoogle.com/.

Google's proprietary technology and malware detection tools are used to regularly scan all creatives. Fourth-party calls or sub-syndication to any uncertified advertisers or vendors are forbidden. Any ad distributing malware is pulled to protect users from harm. Any Authorized buyer whose creative is found to contain malware is subject to a minimum three-month suspension. If you have a creative under policy violation, learn how to resolve it.

Creatives that trigger automatic-redirects or pop-ups

Auto-redirects are a form of malvertising that automatically click and unexpectedly take users to another site in a user’s browser or mobile app when rendered. Similarly, pop-ups are a form of malvertising that render system dialog boxes over the website enticing the user to click.

Google prohibits this behavior and is constantly improving detection and enforcement. The large majority of Ad Exchange and Google demand uses technical solutions to stop this malicious creative activity in Chrome, the Mobile Ads SDK, and other platforms.

Other exchanges, networks, and partners transacted through header bidding and remnant or reservation line items might not have the same policies and protections. Ensure that your demand sources have adequate policies to prohibit and protect against this behavior.

SafeFrame automatic protections enabled

SafeFrameis turned onby default for all reservation creatives. This may break some creatives, and those creatives may require updating to display properly. While it is possible to turn offthe SafeFramefeature, we highly recommend keeping it turned on.

SafeFrame is automatically enabled for all backfill creatives, and sandboxing is also enabled for browsers that support it.

For enhanced security, you may choose to use the setSafeFrameConfig and the setForceSafeFrame methods in the GPT API. These methods are used to overridethe configuration set in Ad Manager and force ads in a specific slot to always render in a SafeFrame. If you implement these methods, it is important toset up your reservation creatives with SafeFramein mind.

If you implement third-party JavaScript libraries to integrate non-Google demand onto your pages, be aware that some of these libraries will circumvent Google's malware protections by rendering their content in friendly frames.

Creative that loads a blank or white page

When an ad is clicked or tapped, it should open the target destination. If a blank or white page is loaded instead, it can be caused by the following issues:

1. The URL automatically redirects the user. Auto-redirects are a form of malvertising that automatically click and unexpectedly take users to another site in a user’s browser or mobile app when rendered. Google prohibits this behavior. Learn more about automatic redirects and malvertising.
2. The landing page domain may be affected by malware. Google actively works with trusted advertisers and partners to help prevent malware in ads. All publishers and ad networks should follow the security recommendations detailed at https://anti-malvertising.withgoogle.com/.

   You can also review the tips on the Google Developers' page, "How do I know if my site is hacked?" Additionally, third-party sites, such as Sucuri and PCRisk may be able to detect the issue.

Report a violation from a Google exchange or network

If you see an automatic redirect or pop-up from AdWords, AdSense, or Ad Exchange, contact publisher support with a recorded HTTP log of the redirect behavior, required for investigation.

Publisher support teams cannot investigate creatives from third-party exchanges or networks.