Google Ads IP exclusions

Connect Google Ads#

Under Protect → Rules & Google Ads API enter the developer token, OAuth client id / secret, refresh token, customer id and (optionally) login customer id. Credentials are encrypted with CREDENTIALS_KEY. The connection test lists your active campaigns.

Negative IP sync#

Every blocklist entry is pushed as an IpBlock campaign criterion to each active campaign:

• Google allows 500 IP exclusions per campaign; WhichClick fills the slots with the highest-scoring, most recent entries and rotates expired ones out.
• IPv6 is excluded at the /64 (Google's minimum granularity); IPv4 as single addresses or /24 when a subnet is blocked.
• Sync runs automatically after each new invalid verdict (debounced 60 s) and via POST /api/protect/sync or the scheduler.
• IpBlock.googleCriteria records the criterion resource name per campaign so removals are exact; lastSyncError surfaces API errors.

Incident auto-pause#

When an incident opens on a campaign and auto-pause is enabled, the campaign status is set to PAUSED through the API and a webhook (incident.opened) is sent. Resolving the incident does not automatically resume the campaign — that is a human decision.

{ "type": "incident.opened", "campaign": { "id": "…", "name": "Brand — Search", "externalId": "2098765432" }, "invalidClicks": 63, "windowMinutes": 10, "topIps": ["203.0.113.0/24"], "autoPaused": true }

Refund claims#

Google's invalid-activity review requires evidence. Export it with GET /api/protect/export?days=30 (CSV with timestamp, IP, gclid, campaign, ad group, reasons, score) and attach it to the invalid clicks contact form. Keep the exclusion list in sync — reviewers check that you took action.

Microsoft Ads#

The same blocklist can be exported as a Microsoft Ads IP exclusion CSV from Protect → Blocklist; API sync is on the roadmap.