Google Ads IP Exclusions: The Complete Guide

A Google Ads IP exclusion stops your ads from being served to a specific IP address, and it is the only direct blocking control Google hands advertisers inside the account. Everything else you can do about wasted clicks is indirect. Bid adjustments, audience exclusions, placement exclusions, tighter geo targeting: all of them shift the odds. IP exclusion is the one setting that says not this visitor, not at all.

That is why it gets reached for first when a search budget starts looking wrong. It is also why so many advertisers end up disappointed with it. The setting works exactly as documented. The problem is that what it does and what people expect it to do are two different things. This guide covers both.

What a Google Ads IP Exclusion Actually Does

When you add an address to the exclusion list, Google stops entering your ads into auctions for traffic it identifies as coming from that address. No impression, no click, no cost. It is a serving-side control, which is the important part. The block happens before the auction rather than after the click, so nothing is billed and then argued about later.

A few properties of the setting are worth holding onto:

• Exclusions can be set per campaign or at account level. Account-level exclusions apply to every campaign, including Performance Max, so one list can cover the whole account.
• Google Ads allows up to 500 IP address exclusions per campaign.
• You can enter single addresses or ranges, which is how most advertisers stretch that 500 slot budget.
• The exclusion applies to serving only. It does not affect Analytics, your CRM, or anything else that logs the visit.

Used well, this is a clean tool. A competitor with a static office IP who clicks your ads every morning gets shut out permanently in about ninety seconds of work. That is a real win and it costs nothing.

How to Exclude an IP Address in Google Ads

The path moves around as Google reshuffles the interface, but the sequence has been stable for years:

• Open the campaign you want to protect. This is campaign level, so pick deliberately.
• Go to Settings, then open Additional settings.
• Expand IP exclusions.
• Enter one address per line. Ranges use standard notation.
• Save, then repeat for every other campaign that needs the same protection.

Two things trip people up here. First, saving on one campaign does nothing for the others, and there is no built-in way to push a list across an account. Second, there is no confirmation that the address you pasted is the one actually doing the clicking. Google will accept any syntactically valid entry without comment. Get a digit wrong and you have quietly blocked a stranger, or a customer.

Check the entry before you save it

Look up what each address belongs to before it goes in. A consumer ISP, a corporate network and a hosting provider are three different situations. The hosting provider is usually a safe block for a local service business. The corporate network might be a prospect's office. The consumer ISP could be anyone next week, because that address probably gets reassigned.

The IP Exclusion Limit in Google Ads

Five hundred entries per campaign sounds generous until you start filling it. For a handful of known offenders it is far more room than you need. For anything resembling systematic click abuse it disappears fast, because the traffic you are trying to stop rarely comes from a fixed set of addresses.

The limit is a hard ceiling, not a soft one, and it forces a maintenance decision: once the list is full, every new address you want to block means removing an old one. Which raises the question of whether the old one was still doing damage. Most advertisers never find out. We covered what happens at the ceiling in more detail in the 500 IP exclusion limit and what happens when you hit it.

Where Google Ads IP Exclusions Fall Short

None of what follows means the setting is useless. It means the setting solves a narrow problem, and most click waste is not that problem.

Residential addresses rotate

Consumer broadband connections are usually assigned dynamically. The address that clicked your ad on Tuesday may belong to a different household by Friday. Block it and you have blocked a moving target that already moved, while potentially shutting out a legitimate prospect who inherited it.

Mobile traffic barely has a fixed address at all

Carrier networks route large numbers of subscribers through shared gateway addresses. Excluding one of those can wall off a meaningful slice of mobile users in a region. The exclusion works perfectly. It just costs you more than it saves.

Automated traffic changes address by design

Anything scripted can cycle through address pools without effort. This is the structural problem with a static blocklist against non-static traffic, and it is the same dynamic we describe in our guide to bot traffic in Google Ads. You are updating a list by hand against something that changes addresses automatically.

Performance Max needs the account-level list

Campaign-level IP exclusions are not available for Performance Max, video, hotel, app and Smart Display campaigns. Account-level IP exclusions apply to all campaigns in the account, including Performance Max, so if your spend has moved there, that is the list to use. We cover the details in Performance Max IP exclusions.

Finding the Addresses Worth Excluding

Google Ads does not show you the IP address of a click. Not in the interface, not in reports, not in the API. So every exclusion list starts somewhere else: server logs, analytics with a custom dimension, or a tracking layer that records the visit and ties it back to the ad click.

This is where most exclusion projects stall. Getting the address is straightforward. Proving that a given address is responsible for the clicks you are being charged for takes stitching two data sources together, and doing it badly produces confident, wrong exclusions. The method matters, which is why it has its own walkthrough: how to find the IP addresses behind fraudulent ad clicks.

The cost of a wrong exclusion is invisible

Worth dwelling on, because it changes how careful you should be. When you block an address that was producing junk, you see the spend drop and you feel good. When you block an address that was producing customers, nothing happens in any report. The inquiries simply do not arrive, and there is no line item anywhere labelled buyers you shut out. That asymmetry is the argument for doing the identification work properly rather than blocking on a hunch.

Refunds Are Not a Substitute for Blocking

Google does issue automatic credits for clicks its systems classify as invalid, and those credits appear on the account without you asking. What Google does not do is disclose the criteria behind that classification. You cannot see what was caught, what was missed, or why. Treating the credit as proof that the problem is handled is a mistake a lot of accounts make. We go into what the credits cover and what they do not in our piece on Google's invalid click refunds.

The useful distinction is timing. A credit arrives after the click was served and billed. An exclusion prevents the auction entry in the first place. Prevention is worth more, which is the whole argument for maintaining a list at all.

Where IP Exclusions Fit in a Wider Defense

Think of the exclusion list as the manual layer. It handles known, stable, identified offenders and it handles them permanently. It does not scale, it does not adapt, and it cannot see anything you have not already investigated by hand.

For accounts where the stakes per click are high, the manual layer alone leaves too much exposed. Legal is the clearest example, with click costs that make a single bad session expensive enough to notice, which is why we treat it separately in our guide to click fraud targeting law firms. Where the waste is continuous rather than occasional, automated click fraud protection is what closes the gap between what you can catch by hand and what is actually hitting the account.

The Practical Verdict

Set up IP exclusions. They are free, they take minutes, and for a known repeat offender with a fixed address they are the correct answer. Just be honest about the ceiling: 500 entries per list, no visibility into who is clicking, and no defense against anything that changes address.

Keep a record outside the platform too. Date every entry, write down why it went in, and review the list on some kind of schedule. Google stores none of that for you, and an undocumented list becomes unmaintainable within a year because nobody can remember which entries still matter.

If you have added addresses and the wasted spend has not moved, the list is not failing. It is doing its job on a problem that was never the one costing you money. At that point the answer is better detection, not more entries.

Compare IP Exclusions Against the Alternative

Blocking at the server is the other approach advertisers try, and it fails for a reason that is easy to miss until you look at the billing timeline. We put the two side by side in IP exclusions versus server blocking.