My WordPress website was compromised, and I’ve taken extensive steps to clean and secure it.
I removed a number of plugins, ran multiple security scans, and implemented additional security measures. I’ve checked the site using Google Safe Browsing, Sucuri, and Google Search Console, and none of them currently report any malicious content or security issues.
I also searched for the specific malicious/signature URL or code that Google may have detected. I searched across all website files and also searched the WordPress database directly through phpMyAdmin, but I couldn’t find any trace of it.
In addition, my hosting provider has reviewed/scanned the website and cleared it as safe.
Despite all of this, every time I submit an appeal through Google Ads, it is still rejected because Google says the website is compromised.
At this point, I’m trying to understand what Google Ads could still be detecting that isn’t being picked up by Safe Browsing, Sucuri, Google Search Console, my hosting provider, or a manual search of the WordPress files and database.
Could there be something else I should be checking, such as cached content, redirects, server-level files, DNS, a hidden WordPress user/account, or content being served conditionally to Google?
How can I determine exactly what Google Ads is still detecting so I can resolve the issue and have the appeal approved?
Source: r/Google_Ads · by /u/symo87