Google Ads IP blocking: the 500 IP limit and why it falls short

When suspicious clicks show up, the first instinct is almost always the same: "Let's block that IP." Google Ads has a built-in tool for exactly this, and used well it still works. But on today's internet — shared mobile carrier addresses, IPv6, VPNs and residential proxies — an IP list is no longer a protection strategy on its own. This article walks through how to set up IP exclusions step by step, where they break down, and the approach that goes beyond them.

What is an IP exclusion in Google Ads?

An IP exclusion is a campaign setting that stops your ads from being shown to users on the IP addresses you specify. No impression means no click, and no click means no spend. It is available for Search, Display, Shopping, Demand Gen and YouTube campaigns. According to Google's help center, IP exclusions are not available for Performance Max, app, hotel and smart display campaigns.

One important nuance: an IP exclusion is not a "block" — it is a serving restriction. The excluded person can still visit your website directly; they just won't see your ads. The goal is to protect ad budget, not the site itself.

Step by step: how to exclude an IP in Google Ads

1. Sign in to Google Ads and select the campaign in the left-hand menu.
2. Open the campaign's Settings tab and expand "Additional settings".
3. Click "IP exclusions".
4. Paste the addresses, one per line. To exclude a block, replace the last group with an asterisk (for example 203.0.113.*).
5. Save. The change usually takes effect quickly, but it does not refund clicks that were already charged.

Google now also supports account-level IP exclusion lists. When both account- and campaign-level lists exist, Google merges them. If you run several campaigns, moving shared addresses to the account level cuts maintenance.

Which IPs belong on the list?

Because the list is limited, be selective. Sensible candidates are:

• Your own office and team IPs (your employees' clicks cost money too).
• Fixed addresses that click repeatedly in a day without ever converting.
• A known competitor's office IP — when you have clear evidence from server logs.
• Visits from data center (hosting) ranges that show no human behavior.

If you don't know where to find these IPs, your server access logs or a tracking tool are the starting point. We cover this in detail in our guide to detecting fake clicks.

Finding suspicious IPs in your server logs

The Google Ads interface never shows you the IP of the person who clicked. That information only exists on your side — in your web server's access logs or in a tracking script on your site. The most practical way to isolate ad clicks is the gclid parameter in the URL. A basic review looks like this:

1. Pull the access logs for the last few days and filter for requests containing gclid.
2. Group those requests by IP address and count how often each one appears.
3. Flag addresses that arrive at short intervals with no follow-up page requests.
4. Check which network each flagged address belongs to (residential, mobile carrier, data center) with an IP lookup tool.
5. Shortlist only fixed, recurring addresses for exclusion; treat mobile carrier addresses separately.

This works for a handful of addresses, but it is manual work that has to be repeated daily. And the log alone cannot tell you whether an IP belongs to one person or hundreds. That uncertainty is the root of the limitations below.

Common mistakes

• Excluding an IP based on a single click: one click is not enough evidence.
• Copying the same list into every campaign: maintenance multiplies; an account-level list is cleaner.
• Never pruning the list: dynamic addresses get reassigned, and a stale entry can block a real customer.
• Adding the IPv4 address but forgetting the same source's IPv6 address: Google recommends adding all versions.

What the 500 IP limit means in practice

Google's official cap is 500 IP addresses per campaign. On paper that sounds generous, but a bot network can rotate through hundreds of addresses in a single day. Once the list is full you have to delete old entries to add new ones, which turns protection into a never-ending manual rotation.

More importantly, a 500-entry list only works against an attacker who never changes address. Every source that rotates makes the list meaningless. The real problem isn't the cap itself — it's that an IP is no longer a reliable identity.

Four fundamental limits of IP blocking

Mobile traffic: the easiest path to false positives

In many industries in Turkey, ad traffic comes predominantly from mobile devices. Mobile carriers commonly use CGNAT to share one public IP among many subscribers. A mobile IP you block as "suspicious" may also hide your ads from potential customers sharing that address at that moment. Broad wildcard ranges amplify the risk.

VPN rotation and residential proxies

Someone clicking on purpose — a competitor or a click farm — typically uses a fresh IP for each session. Residential proxy networks rent real household connections so the traffic looks like "normal users". Against this kind of traffic an IP list is always one step behind. For how bot traffic works under the hood, see our anatomy of bot traffic.

Doesn't Google already filter invalid clicks?

Yes, it does. Google's automated invalid click systems filter known bot signatures, rapid meaningless repeat clicks and similar patterns in real time; you are not charged for those clicks, or you are credited later. For clicks you believe slipped through, you can request an investigation — see our Google Ads refund request guide.

What Google's filter doesn't know is your business context: who your competitors are, how a normal customer behaves on your site, at what hours conversions come in. Third-party protection targets exactly that gap — not to replace Google, but to add the signals it cannot see.

A better approach: signals instead of IPs

When an IP is no longer a reliable identity, protection has to weigh several signals together. The signal-feedback approach wall.click uses works roughly like this:

• Behavior score: do dwell time, scrolling, mouse/touch movement and interaction patterns look human?
• ASN and data center detection: does the click come from a home or mobile connection, or from a hosting provider?
• Device fingerprint: is the same device coming back even though the IP changes?
• Feedback to Google: sending valid visits and conversions back as signals helps automated bidding steer toward quality traffic.
• Targeted exclusion: the IP list is reserved for truly fixed, recurring sources, so the 500-entry quota isn't wasted.

You'll find the details on our bot detection solution page and the full capability list under features.

When is an IP list still the right tool?

There's no need to abandon IP exclusions. For a competitor clicking from a fixed office IP, your own staff or a specific server range, it's still the fastest and cheapest tool. The problem is relying on it as your only line of defense.

An example scenario

Picture a business serving one city. The owner grows suspicious of clicks arriving at the same morning hours that never lead to a call. The server logs show some of them come from a fixed office connection, so that address is excluded and those clicks stop. A few days later, clicks with the same timing and behavior start arriving from different mobile addresses. Those addresses change daily and are shared with many real users in the area.

At that point the IP list stops working. What makes the difference are the signals that stay constant while the address changes: the same device characteristics, the same visit pattern, the same time window. Signal-based protection catches that pattern; it targets behavior rather than an address, and leaves the real customers behind a shared IP untouched.

Actionable checklist

• Exclude office and team IPs at the account level.
• Review campaign lists regularly and remove addresses that no longer send traffic.
• Think twice before blocking mobile IPs or wide ranges.
• Make sure conversion tracking works; bidding algorithms learn from it.
• Monitor Google's invalid clicks data and file an investigation within 60 days when needed.
• Add a layer that catches recurring devices and bot behavior that IPs can't reveal.

Frequently asked questions

Can an excluded IP still visit my site?

Yes. An IP exclusion only stops your ads from being shown; it doesn't prevent direct or organic visits.

How many IPs can I exclude in Google Ads?

Up to 500 IP addresses per campaign, according to Google's documentation. You can also define an account-level list; the two are merged for each campaign.

Can I block an IP range?

Yes — replace the last group with an asterisk (for example 203.0.113.*). On mobile and shared addresses, though, this can exclude real customers too.

Are IP exclusions available in Performance Max?

No. Google's documentation lists Performance Max, app, hotel and video among the campaign types without IP exclusions. There, sending high-quality conversion signals matters more.

Will blocking an IP stop a competitor completely?

Largely, if they click from a fixed IP. Not if they use mobile data, a VPN or different networks — then you need device and behavioral signals.