Seatext library / BotRefund evidence

How to Clean Up Google Ads After a Pixel Poisoning Attack

Pixel poisoning corrupts your conversion data by feeding Google Ads false signals from bots and scrapers. Clean up by removing malicious code from your site, resetting the Google Ads pixel, auditing every campaign for...

✓ Built for advertisers who need clear, refund-ready traffic evidence.

Immediate containment: stop the bleeding

If you suspect pixel poisoning, act fast. The longer corrupted data feeds Google's bidding algorithms, the more budget you waste on non-human clicks. Start with these three containment steps before any deep audit.

  1. Pause affected campaigns. Halt spend on any campaign that shows sudden CTR spikes, near-zero conversion rates, or traffic from unfamiliar placements.
  2. Remove the compromised pixel. Delete the current Google Ads conversion tag (gtag.js or GTM container) from every page. This cuts the feedback loop that teaches Google to optimize for bots.
  3. Scan your site for injected scripts. Attackers often plant malicious JavaScript that fires conversion events automatically. Use a malware scanner or your CMS security plugin to find and delete unauthorized code.

Reset and reinstall a clean pixel

After containment, you need a fresh conversion pixel that only fires on genuine human actions.

  1. In Google Ads, go to Tools → Conversions and create a new conversion action. Give it a distinct name (e.g., "Purchase – Clean") so you can separate old and new data.
  2. Copy the new global site tag or GTM snippet. Paste it into the <head> of every page, or deploy via GTM with a trigger that fires only after a verified user interaction (form submit, button click, thank-you page load).
  3. Add a client-side behavioral filter before the pixel fires. BotRefund's approach captures GCLIDs with behavioral evidence — mouse movement, scroll depth, dwell time — so the pixel only triggers for sessions that pass human checks.S2

Audit every campaign for poisoned metrics

Pixel poisoning skews the numbers you rely on for bidding, targeting, and budget allocation. Run a systematic audit:

  • Search terms report: Filter for queries with high clicks and zero conversions. Add these as negative keywords.
  • Placement report (Display/Video): Identify sites or apps with high impressions, high clicks, and zero engagement. Exclude them at the campaign level.
  • Audience segments: Check "Unknown" or "Other" demographics that suddenly dominate. Exclude or bid down.
  • Device and geo anomalies: Bots often cluster in specific device types (e.g., older Android versions) or data-center IP ranges. Apply bid adjustments or exclusions.

Google's automated filters catch less than 50% of invalid traffic; the rest is classified as sophisticated invalid traffic (SIVT) that requires manual evidence submission.S1

Rebuild bidding on verified human data

Your smart bidding strategies (Target CPA, Target ROAS, Maximize Conversions) have been trained on poisoned data. Reset them:

  1. Switch affected campaigns to Manual CPC or Enhanced CPC for 2–3 weeks while the new pixel accumulates clean conversions.
  2. Set conversion windows to 30 days (or your typical sales cycle) and enable "Include in Conversions" only for the new, clean conversion action.
  3. Once you have at least 30–50 verified conversions, re-enable smart bidding. Monitor the learning period closely.

Submit refund requests with forensic evidence

Google Ads allows refunds for invalid clicks, but you must provide evidence. The standard dispute form asks for:

  • Campaign IDs and date ranges
  • Click IDs (GCLIDs) of suspected invalid clicks
  • Explanation of why the clicks are invalid
BotRefund automates this by capturing GCLIDs with behavioral evidence and generating audit-ready refund dispute reports.S2 Attach these reports to your Google Ads support ticket to increase approval odds.

Harden your site against re-infection

Pixel poisoning often starts with a compromised website. Implement these defenses:

  • Content Security Policy (CSP): Restrict which scripts can execute. Block inline scripts and only allow trusted domains.
  • Subresource Integrity (SRI): Add integrity hashes to third-party scripts so the browser rejects modified files.
  • Regular malware scans: Schedule daily scans via your hosting provider or a security plugin.
  • Limit GTM/GA access: Use the principle of least privilege. Only trusted team members should have Publish rights.
  • Real-time bot blocking: Deploy a solution that blocks pixel poisoning in real time by detecting and stopping bots before they trigger conversion events.S1

Key facts: pixel poisoning at a glance

MetricDetailSource
Global ad fraud projection (2026)Over $100 billionS1
Average invalid click rate on Google Ads11% to 14%S1
Google's automated filter catch rateLess than 50% of invalid trafficS1
Remaining traffic classificationSophisticated Invalid Traffic (SIVT) — requires manual evidenceS1
BotRefund refund success rate (high-volume advertisers)83%S2
Historical refund reachGoogle Ads spend dating back to 2017S2

Limitations and when this advice doesn't apply

  • Account compromise vs. pixel poisoning: If your Google Ads account itself was hacked (unauthorized users, changed billing), follow Google's account recovery flow first. The steps above assume the account is secure but the pixel data is corrupted.
  • Server-side tagging only: If you use server-side GTM with no client-side pixel, the attack surface differs. You still need to audit server logs for forged conversion API calls.
  • Low-volume accounts: Accounts with under 30 conversions/month may not meet smart bidding minimums even after cleanup. Manual bidding may remain the best option.
  • Non-Google platforms: This guide covers Google Ads. Meta, TikTok, and LinkedIn have separate pixels and refund processes (BotRefund also supports Meta Pixel protection and FBCLID captureS7).

Terminology

Pixel poisoning
When bots or malicious scripts fire your conversion pixel, feeding false success signals to the ad platform's bidding algorithm.
GCLID (Google Click Identifier)
A unique parameter appended to landing-page URLs that ties a click to a specific ad interaction. Required for refund disputes.
SIVT (Sophisticated Invalid Traffic)
Invalid traffic that mimics human behavior well enough to bypass automated filters. Requires behavioral evidence to prove.
CSP (Content Security Policy)
An HTTP header that tells the browser which script sources are allowed to execute, reducing injection risk.
SRI (Subresource Integrity)
A hash attribute on <script> tags that ensures the fetched file matches the expected content.

FAQ

How long does it take for smart bidding to recover after a pixel reset?

Expect 2–4 weeks. The algorithm needs 30–50 clean conversions to exit learning. During this window, use Manual or Enhanced CPC and monitor daily.

Can I keep the old conversion action for historical reporting?

Yes. Rename it (e.g., "Purchase – Legacy") and uncheck "Include in Conversions." Keep it for year-over-year comparisons, but never bid on it.

What if Google rejects my refund request?

Re-open the case with additional evidence: behavioral logs (mouse paths, scroll depth, dwell time), IP reputation reports, and placement-level anomaly charts. BotRefund's dispute reports are formatted for this exact escalation.S2

Does pixel poisoning affect Performance Max campaigns differently?

Yes. PMax blends search, display, YouTube, and Discover. Poisoned pixels corrupt the cross-channel model. Exclude suspicious placements at the asset-group level and consider pausing PMax until clean data accumulates.

How often should I audit for pixel poisoning?

Monthly for high-spend accounts ($50k+/mo). Quarterly for smaller accounts. Automate alerts: flag any day where conversions drop >50% while clicks stay flat or rise.

Can a competitor deliberately poison my pixel?

Yes. Competitor click fraud networks sometimes fire conversion pixels on your site to corrupt your bidding data, making your campaigns inefficient. Real-time bot blocking that detects honeypot interactions and pointer behavior helps prevent this.S2

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

Learn more

Visit the website for more information.

Learn more