AdSense flagged invalid traffic. Before you do anything, figure out which of two very different states you’re in, because the right move is opposite for each:
- Ad serving limited (banner: “Ad serving on your account is being temporarily limited while we assess your traffic quality” or “…due to invalid traffic concerns”). This is an automated throttle. There is no appeal form. It typically clears on its own in under 30 days (as of June 2026). The worst thing you can do is panic and rip out your ad units, because Google needs clean impression data to lift it.
- Account closed / disabled for invalid traffic (email + a permanent-sounding notice, earnings reversed). This one you must appeal through the invalid activity appeal form with specific evidence.
Fastest path: open AdSense → Account → Policy center and read the exact status string. If it says “limited,” keep your ads up, find and kill the bad traffic source, and wait. If the account is closed, gather data and file one well-documented appeal.
This is one of the most stressful AdSense states because the warning is vague, appeals are slow and frequently denied, and a confirmed closure for invalid traffic means you can’t open a new account. Google’s invalid traffic policy lumps click fraud, bot traffic, “encouraging clicks,” and traffic from low-quality sources all under “invalid traffic,” and Google deliberately won’t tell you which, because, in their words, they “cannot share information that could be used to circumvent our invalid traffic defenses.”
Limited vs. closed: which bucket are you in
| Signal | Ad serving limited | Account closed / disabled |
|---|---|---|
| Where you see it | Policy center banner, ads still partly serve | Email from Google, ads fully off |
| Appeal available | No formal appeal (automated) | Yes — invalid activity appeal form |
| Typical duration | Usually under 30 days, auto-clears | Permanent unless appeal succeeds |
| Earnings | May be withheld during review | Reversed/forfeited |
| Best action | Keep ads live, fix source, wait | Document, appeal once, well |
| Remove ad units? | No — kills the clean data Google needs | N/A |
If you only have a limited status, you can skip the appeal section entirely. Diagnose the source (below), apply defenses, and let it auto-recover.
Common causes
Ordered by hit rate, highest first.
1. Someone is maliciously clicking your ads
A competitor or angry user finds your site and clicks ads dozens of times. AdSense’s anti-fraud system flags the spike. Often this is unintentional collateral from a “negative SEO” attack.
How to spot it: AdSense → Reports → set the metric to Clicks and Page CTR, view by day. If a single day or hour shows CTR 5-10x your baseline, you have a click spike.
2. You or family members accidentally clicked
You opened your own site in a browser logged into your AdSense account and clicked an ad to “test if it works.” This is the #1 cause of self-inflicted invalid traffic flags for new publishers.
How to spot it: Did you click an ad in the last 30 days? Did anyone with access to your computer click? If yes, this is probably it. (Use AdSense’s ad preview / publisher tools to test ads safely instead — never a live click.)
3. Bot / scraper traffic spike
A scraper hit your site 50,000 times in a day. Each pageview triggered an ad impression. AdSense’s traffic-quality system saw a flood of obviously-bot traffic and flagged it.
How to spot it: Cloudflare → Analytics & Logs → Traffic, look for spikes. Or GA4 → Reports → Acquisition → Traffic acquisition, sort by an unusual source/referrer.
4. You bought or incentivized traffic
You ran a $5 cheap-traffic campaign on a sketchy network, or a service like a “traffic bot” pinged your pages. These all register as invalid. Google explicitly warns publishers to vet sources with its traffic provider checklist, and treats most purchased traffic as invalid.
How to spot it: Look back at the last 30 days — did you buy any traffic? Even legitimate-seeming services (some Fiverr “I’ll send 1000 visitors” gigs) count as invalid.
5. Auto-refresh widgets / pop-up traffic
You enabled an auto-refresh feature, or your site has a sticky pop-up that inflates pageviews. AdSense detects that engagement signals don’t match impression volume.
How to spot it: In GA4, average engagement time < 5s paired with high pages/session is the signature of automated or low-quality engagement.
6. CTR anomaly without a click spike
Sometimes AdSense flags pages with sustained CTR above roughly 5-10% even without large absolute click volume. CTR that high is usually caused by misleading ad placement (ads that look like content or navigation) and triggers a manual review.
How to spot it: AdSense → Reports → Page CTR sustained above 5%. Even legit traffic can trip this if your placement is confusing.
7. Misleading content or prohibited categories
If recent content has crossed into a prohibited area (adult, certain medical, illegal goods), a reviewer may use “invalid traffic” as the umbrella label while actually citing content policy.
How to spot it: Check the Policy center for any per-page enforcement actions in the same window. If you see content-policy flags too, fix those first.
Shortest path to fix
Step 1: Read the exact status string
AdSense → Account → Policy center. Note whether it says limited (automated, no appeal) or closed/disabled (appeal required), and copy any specific phrase such as “encouragement of clicks,” “click manipulation,” “traffic source quality,” or “high-risk behavior.” You’ll need the exact text for an appeal.
Step 2: Pull traffic and CTR data for the flagged period
AdSense → Reports → set the date range to the suspicious 7-30 days and export:
- Impressions, clicks, and Page CTR by day
- Top URLs by clicks
- Top countries by clicks
Cross-reference with GA4 or your CDN/server logs and pinpoint the anomaly (a single day, a single country, a single referrer, or a single IP range).
Step 3: Document defenses (only needed if the account is closed)
If you can show the traffic was malicious or unintentional, save:
- Cloudflare Bot Fight / WAF logs from the period
- Geographic and time-of-day analysis showing the clicks don’t fit a normal user pattern
- Any communication with a suspected perpetrator (rare, but useful if it’s a known competitor)
- The anti-fraud measures you already had in place (reCAPTCHA, rate limiting, etc.)
You can also proactively report an ongoing attack with Google’s invalid clicks contact form so it’s on record before you appeal.
Step 4: File one appeal with evidence (closed accounts only)
Use the invalid activity appeal form. Provide the email address associated with the closed account so Google can locate it. A strong appeal follows this shape:
- The specific time window of suspicious traffic
- What you believe caused it (be concrete)
- What defensive measures you’ve already added since
- Why you believe the activity wasn’t your doing or negligence
Be specific. “Adjusted ad placement from 50px to 200px below the header and enabled Bot Fight Mode on 2026-06-10” beats a generic “I didn’t do anything.” Attach before/after screenshots and your traffic reports.
One-shot rule (as of June 2026): “After we’ve reached a decision on your appeal, further appeals may not be considered.” In practice you can submit only one appeal per 90 days, so do not file a rushed, evidence-free appeal. Get it right the first time.
Step 5: Add defenses to prevent recurrence
For click fraud / malicious clicks:
- Enable Cloudflare Bot Fight Mode (free tier is fine)
- Add reCAPTCHA v3 if your stack supports it
- Block the IP ranges that produced the suspicious clicks at your CDN/server — Google cannot block IPs on your behalf, so you must do it yourself in Cloudflare WAF or your host
For accidental self-clicks:
- Use an ad blocker (uBlock Origin) on your own work machine
- View your own site in a separate browser profile or incognito, logged out of AdSense
- Never click your own ads, even to “test”
For bot traffic:
- Turn on Cloudflare bot management / managed rules
- If you see scraper signatures, block their user agents or networks at the WAF (robots.txt only stops well-behaved crawlers, not abusive bots)
Step 6: Wait — and do NOT remove your ad units
For a limited status: keep ads live and wait it out (usually under 30 days). Removing ad units stops Google from collecting the clean impression data it needs to lift the limit, which can stretch the throttle indefinitely.
For a closed account: appeals can take hours, days, or weeks — sometimes months, with no fixed SLA. Don’t keep filing; that won’t speed it up and burns your one shot. Work on content and defenses while you wait.
If an appeal is denied: read the denial carefully. A closure for invalid traffic is usually final, and you are not permitted to open a new AdSense account afterward, so a second account will likely be auto-disabled too.
How to confirm it’s fixed
- Limited status: the Policy center banner clears and your Reports show ad serving recovering to normal volume. There is no notification email; check the Policy center.
- Closed account, appeal granted: you receive an email and ad serving resumes. Verify in Reports that impressions return.
- Either way: watch Reports → Page CTR for the next few weeks. If CTR stays in a normal band (typically
1-3%for display) and no new banner appears, you’re stable.
Prevention
- Never click your own ads. Use an ad blocker on your work machine.
- Enable Cloudflare Bot Fight Mode the day you launch.
- Don’t buy traffic from any source, including “high-quality SEO traffic” promises on Fiverr. Vet anything paid against Google’s traffic provider checklist.
- Monitor AdSense Reports → Page CTR weekly. Investigate any day with 3x your baseline CTR even if no warning has fired.
- Don’t place ads where they look like navigation or content; high CTR from confusion reads as invalid traffic to Google.
- Keep a dated change log of ad placement and traffic changes so you can correlate with any future incident, and so you have a paper trail for an appeal.
FAQ
Is “ad serving limited” the same as a ban? No. A limit is an automated, usually temporary throttle that clears on its own (commonly under 30 days). A ban/closure is a manual decision that reverses earnings and requires an appeal. Check the exact wording in the Policy center.
Should I remove my ads while limited? No. Removing ad units prevents Google from collecting the clean data needed to lift the limit. Leave them up, fix the bad traffic source, and wait.
How long does an invalid traffic appeal take? There is no published SLA. It can be hours, days, weeks, or months. You can typically submit only one appeal per 90 days, and after a decision, further appeals may not be considered.
Will Google tell me exactly what triggered the flag? No. Google withholds specifics on purpose so the system can’t be gamed. Use your own Reports, GA4, and CDN logs to identify the most likely source.
Can I open a new AdSense account if mine was closed for invalid traffic? No. Publishers closed for invalid traffic are not allowed back into AdSense; a new account is likely to be auto-disabled. Appeal the existing account instead.
Can I block the attacker’s IPs myself? Yes, at your CDN or server (Cloudflare WAF, host firewall). Google cannot block IP addresses you submit, because blocking shared IPs would also kill legitimate clicks, so the blocking has to happen on your side.
Related
- AdSense policy warning
- Ad blocker affecting RPM
- No ads available on some pages
- Ads not showing after approval
Tags: #Troubleshooting