Ask HN: Google Ads Rejected My SaaS as Compromised Site

I’m a solo founder and really struggling to get Google Ads running for my website. My site always gets flagged as Compromised Site and Malicious Software, even though I’ve done several checks that shows it’s clean. Even Google’s own Safe Browsing shows it as clean.

Their latest feedback after appealing suggests I change from a .co.uk to .com to resolve the issue which seems like complete nonsense.

Does anyone have any suggestions on how I can fix this? All of my competitors are running ads and it’s extremely frustrating as a solo founder that I am unable to do so.

Will post my website on request as I’m not sure if I’m allowed to post it.

Is your domain relatively new? It might be that Google's automated systems don't yet "trust" it due to a lack of history/backlinks, or it could be similar to a flagged domain from the past. This might be why they're suggesting you switch to a different domain.

To improve this, you could work on building more "authority" for your domain by gaining backlinks, which could help increase its trustworthiness. If time is an issue, you might consider purchasing an existing domain with a solid reputation. There are also some SEO tools which can give you insights into a domain.

To be super clear you’re trying to buy ads or serve them? I had a pretty bad experience with buying ads in the past as they kept flagging my account because I was using a virtual CC. I had to reach out to one of my ex-colleagues over there to get unblocked…

I want to buy ads on Google Search results for certain keywords to direct people to my business. I haven't had any trouble with Facebook Ads in the past

I'd bet just about anything that Google uses machine learning to decide whether or not to trust a site for ads. It seems like the only solution that would work at a large enough scale to handle that kind of demand (versus more defined but more labor- and resource-intensive malware/fraud detections). I think that also explains why the review process seems so arbitrary and ineffective - in essence, not even Google knows why Google decided your site was bad. I used to help people with hacked websites, but eventually I had to refuse to work on projects where the only symptom was a Google Ads denial because it was such nonsense. In one case a guy completely removed his site and replaced it with a 0-byte page, and even after we saw Google-owned IP addresses doing a crawl in the site access logs, they still told him there was malware (including a list of infected URLs that no longer existed).

If I'm correct, changing your domain might help in that machine learning algorithms consume tons of signals and maybe altering that particular one would push your site under the "bad" threshold. But it might not do anything. It's a super frustrating problem. I hope you can stumble onto a solution or find someone at Google willing to help.