"Deceptive embedded resources": when an ad or widget is the scam

Catching a deceptive ad in the act

Ad networks rotate creatives, so a single visit often looks fine. Google suggests refreshing the page several times, and notes some ads look different on mobile and desktop. A practical routine:

1. Open an example URL in a clean browser profile with no ad blocker, arriving from a Google search.
2. Reload ten or more times, on desktop and in mobile emulation or on a real phone.
3. Watch for ads that imitate system alerts, fake download buttons, "you have won" overlays, or new tabs opening on their own.
4. In DevTools, keep the Network panel open with "Preserve log" on, so you can see which domain delivered a creative or started a redirect.

URL Inspection's mobile and desktop screenshots help too, though they capture one render only.

Which embeds to suspect on WordPress

• Ad network tags in the header, in ad-insertion plugins, or in widgets. Smaller networks and those that pay for pop-under inventory are the usual source.
• Header bidding or ad exchange wrappers that pull in many demand partners you never chose individually.
• Monetization plugins offering "exit traffic", "tab-under" or "interstitial" revenue.
• Third-party widgets: chat, reviews, social feeds or comment systems that load further scripts.
• Hotlinked images from a domain that has since been taken over.
• Old embeds in posts, such as a video player from a service that no longer exists and whose domain now serves something else.

# External script and iframe hosts across published content
wp db query "SELECT DISTINCT SUBSTRING_INDEX(SUBSTRING_INDEX(post_content, 'src=\"', -1), '\"', 1) AS src FROM wp_posts WHERE post_status='publish' AND post_content LIKE '%<iframe%'" | head -40
grep -rhoE 'src="https?://[^/"]+' wp-content/themes | sort | uniq -c | sort -rn | head

That query only finds the last iframe in each post, so treat it as a starting point, not a full inventory.

Removing the resource and preventing a repeat

Google's instruction is to check the third-party resources on your pages and ensure none are deceptive. In practice:

• Pull the offending network or tag from every page, not only the examples. If you cannot identify which demand partner served the bad creative, remove the whole wrapper until you can.
• Report the creative to the ad network with the domain and screenshot, and ask them to block it. Keep the network off the site until they confirm.
• Use your ad platform's blocking controls for categories and advertisers if they offer them.
• Remove dead embeds and hotlinks to domains you no longer trust.

The same kind of script is often behind other problems too: redirecting phones elsewhere (sneaky mobile redirects) or breaking the back button (back button hijacking), which appear in the Manual actions report instead.

Filing once the ads are clean

When repeated reloads on desktop and mobile show nothing deceptive, select Request Review in the Security issues report. Name the resource:

Deceptive creatives (fake "system update" ads) were served through a
secondary ad exchange in our header bidding setup. We removed that
exchange and the pop-under plugin from all pages. We reloaded each
example URL 20 times on desktop and mobile with no deceptive ads.

Google's estimate for a security review is a few days to a few weeks. Revenue from the removed network stops, and warnings stay until the review passes, so there is no benefit in filing before you are sure. If deceptive ads reappear later, the flag can return; a periodic reload test after any change to your ad setup is cheap insurance.