Blocks and exclusion pushes

What a block is in AdPix#

Every block is one value — an address, a range, an IPv6 range or a device — together with a severity, reasons and an expiry date. On Fraud Protection (/integrity), the Blocks tab shows them all.

A block never touches your site and never stops a visit. It is a row on the exclusion list AdPix keeps for your ad platforms; it takes effect once that list reaches the platform through a push destination or an exported file.

Above the table is one line: "… active blocks · Google allows 500 per campaign". That count covers address-type blocks only; device blocks never go to Google, because Google excludes IP addresses only.

Lifecycle#

The filter above the table has four states:

Every hour AdPix moves blocks whose date has passed to Expired. The lifetime of each new block comes from Block expiry (days) in Protection settings.

The table's columns#

The Release button appears on Active rows only.

Who creates a block#

And four types of value:

Automatic blocks record an IPv4 address as IP address and an IPv6 address as IPv6 /64, and block the device only when the verdict is about the device itself. Shared mobile and carrier addresses are never blocked automatically.

Manual blocks#

The Block an address or device card has three fields:

A manual block always gets Confirmed severity, and its lifetime comes from your settings. It works in every protection mode, Monitor included, and it reactivates a value that was released before. Creating and releasing blocks needs the Editor role or higher on the website.

Releasing a block#

Release moves a block to Released. From that moment:

• it is left out of every later push, and the next push puts it on the remove list so a Google Ads destination deletes the matching exclusion;
• automatic verdicts never bring it back, even if the same address earns a Confirmed verdict again;
• the only way back is a manual block.

If you release a block because the verdict was wrong, add the same address or device to the allowlist as well, so its future clicks are recorded as Clean too.

Google's 500 cap and the ranking#

Google Ads accepts at most 500 IP exclusions per campaign. AdPix ranks the list like this: most severe first, then most recent Last seen, then most Hits. When the addresses go past 500, a line such as "… over Google's limit: the exports keep the most severe and most recent." appears. The overflow is never dropped silently; its size is reported.

The pushed list is built from three sources:

• the Active blocks in this table;
• the addresses of Confirmed paid clicks from the last 30 days — never a carrier address;
• the /24 ranges that traffic from Confirmed networks came from, only when the network is a datacenter, VPN, proxy or Tor network or on the known-fraud list — never a residential or mobile network.

Left out of it: any Released or Allowlisted value, and anything on the allowlist. That is why the pushed list carries Confirmed addresses even in Monitor mode; the mode only decides whether AdPix creates blocks and pushes on its own.

A webhook has no cap and receives every address. In Google Ads, the exclusions you added by hand also take a share of each campaign's 500 slots; when a campaign is full, lower-ranked addresses wait until a slot frees up.

Push destinations#

The Push destinations card is where Push now and auto-push send the list. At the top of the card is the table of current destinations, with Name and Type columns and a Remove button; below it, the form to add one.

Webhook#

For n8n, a firewall or any other HTTP endpoint:

Each push is a POST request with a JSON body, and the secret travels with it in the X-Sovereign-Secret header. Your receiver should compare that header with the secret and reject every other request. The secret is never shown again; if you lose it, remove the destination and create it again to get a new one.

The request body looks like this:

{
  "op": "sync_ip_exclusions",
  "add": ["203.0.113.9", "198.51.100.*", "2001:db8:1:2::/64"],
  "remove": ["192.0.2.44"],
  "property_id": "…",
  "blocks": [
    {
      "block_id": "…",
      "identifier_type": "ip",
      "value": "203.0.113.9",
      "severity": "confirmed",
      "reason_codes": ["ip_velocity_10m", "ip_datacenter"],
      "hits": 14,
      "first_seen": "…",
      "last_seen": "…",
      "expires_at": "…",
      "source": "realtime",
      "status": "active"
    }
  ]
}

The reason_codes are the same stable codes the Reasons labels are built from.

Google Ads IP exclusions#

Set Type to Google Ads IP exclusions and fill in these fields:

For every campaign you named, AdPix adds the list's new addresses and removes only the exclusions it added earlier that are no longer on the list. Exclusions you added by hand are never touched. Only addresses go to Google; devices do not.

Search, Display, Shopping and Demand Gen campaigns accept IP exclusions. Performance Max, Video and App campaigns, and any other type that cannot hold IP exclusions, are skipped without an error, and the destination's other campaigns are updated as usual.

Push now and the Pushes table#

The Push now button on the Pushes card queues the current list for every enabled destination of the website and shows "Push queued.". If the website has no push destination, you get an error saying so instead. Auto-push, its conditions and the fact that it works only in Block mode are covered in Protection settings.

The table under the button shows the last 50 pushes, with Time, Platform, Addresses sent, Status and Last error columns. The status is read live from the delivery queue:

Frequently asked questions#

Related#