Skip to main content

How to Block googleadservices.com and Other Ad-Click Redirects

googleadservices.com is the domain Google uses to record clicks on its ads. When someone clicks a sponsored result or a display ad, the browser first goes to a googleadservices.com address, which logs the click and then redirects to the advertiser's site. It isn't malware, but it is ad tracking, and many network admins block it along with other ad and tracker domains.

You can block it for every device on your network with Zenarmor in a few minutes, either with a single-domain blacklist or by blocking all ad and tracker domains. If the dashboard shows the domain as blocked but clients can still reach it, the troubleshooting section below covers the usual causes.

Before you block it: sponsored links in Google Search go through googleadservices.com. Once it's blocked, clicking a search ad won't open the advertiser's site. Users can still click the normal (organic) result for the same site.

Option 1: Block only googleadservices.com​

Use this to stop googleadservices.com while keeping other ads. It takes a minute.

  1. Open Policies and click the policy you want to change.
  2. Open the Exclusions tab.
  3. Enter googleadservices.com as the domain and set the type to Blacklist. Add a description if you like.
  4. To apply it to every policy on this node, turn on Global.
  5. Click + Add exclusion, then Apply Changes.

Blacklisting a domain also blocks all of its subdomains, so googleadservices.com covers www.googleadservices.com and any other subdomain. You don't need to add them separately.

Repeat for any other ad-click redirect domains you want to stop. Check Live Sessions first to see which ones your clients actually use.

Option 2: Block all ads and ad trackers​

This blocks googleadservices.com together with other ad and tracking domains, including Google Ads, so you don't have to list them one by one.

  1. In Zenarmor, open the Policies page and click the policy you want to change, such as Default. The policy settings open on the right.
  2. Open the App Controls tab and switch on Ads and Ad Tracker.
  3. Open the Web Controls tab and block the Advertisements category. The Moderate Control and High Control web profiles under Category Based Controls already include it.
  4. Click Apply Changes.

Check that it works​

  1. Open Live Sessions and go to the TLS view.
  2. Click Filter and filter by the hostname googleadservices.com.
  3. From a client, search Google for something that shows ads and click a sponsored result.
  4. The session should appear as blocked, and the browser should not reach the advertiser's page through the ad link.

Shows blocked but clients can still reach it?​

This is the question behind our community thread. If the dashboard reports googleadservices.com as blocked but a device still gets through, check these in order.

  1. The device is using a different policy. Each device gets the policy that matches it. To see which policy a session matched, open Live Sessions > Connections, or check the Policy column in any report tab. If it isn't the policy you changed, edit that one too, or use the Global option on the exclusion so it applies to every policy on the node.
  2. The browser is reusing an open connection or cached page. Close and reopen the browser, or test in a private window, after you apply the change.
  3. The browser is using QUIC (HTTP/3). Chrome and other browsers often reach Google services over QUIC on UDP port 443 instead of TCP. Block QUIC so browsers fall back to regular HTTPS, which Zenarmor can filter: open the policy, then App Controls > Media Streaming > Quic UDP Connection, block it, and click Apply Changes.
  4. The device isn't behind the gateway. Phones on mobile data, laptops off-site, or devices on a VPN that bypasses the firewall never pass through Zenarmor on the gateway. Since release 2.7, endpoint protection is included in all editions, including Free and Home, so you can install the Zenarmor endpoint agent (Windows, macOS, or Linux) on those devices and apply the same policy wherever they are.
  5. The device uses iCloud Private Relay or encrypted DNS.
    • iCloud Private Relay (iPhone, iPad, Mac) can be used to get around firewall blocking. Block it as an application under App Controls in the policy.
    • DNS over HTTPS and other secure DNS services don't stop the blocking itself, but they stop the Zenarmor block page from showing. When the block notification page is turned on, Zenarmor blocks the session at its DNS request, which requires seeing the queried domain name unencrypted. To prevent encrypted DNS from being used to bypass your policies, open the policy, go to App Controls > Network Management, and block DNS over HTTPS and DNS over TLS.

If none of these explains it, open a ticket with a Live Sessions export of the session so support can see how it was handled.

Last updated on by Zenarmor