Is it safe to run a Google Ads script? How our read-only scan works
Updated
Pasting code into your Google Ads account can feel risky. That is a healthy instinct. This page explains exactly what our free scan does, and how to judge any Google Ads script before you run it.
What a Google Ads script is
A Google Ads script is a short piece of JavaScript code that runs inside your Google Ads account. Scripts can read reports. Some scripts can also make changes, like pausing ads or changing bids. That is why it pays to know what a script does before you run it.
How the free scan works
- You copy our scan script.
- In Google Ads, open the Tools menu, then Bulk actions, then Scripts (if you can’t find it, search for “Scripts” in the Google Ads search bar).
- Click the plus button to add a new script and paste the code.
- Google asks you to authorize the script. Then you click Run.
The script reads your account data, builds a summary of the last 30 days, and sends that summary to us. We use it to email you your report.
What the script does and does not do
The script only reads. Its only Google Ads calls are:
- AdsApp.search, which reads reports.
- AdsApp.currentAccount, which reads your account’s currency and time zone.
It does not pause, edit, add or remove anything in your account.
To send the summary to us, it uses UrlFetchApp, Google’s standard way for a script to send data to a web address. The summary goes only to SpendCanary.
You can read every line before you run it. The script is short.
Why Google asks for full access
When you run any script, Google asks you to authorize it. Google’s help describes the prompt as asking you to authorize the script “to make changes on your account.”
That wording appears even for a script that only reads. Google Ads has no read-only permission for scripts. Authorization is all or nothing. So the prompt alone does not tell you what a script will do. The code does. That is why we encourage you to read it.
Google’s developer docs also note that you can review the access you have granted on your Google Account’s Security page, under third-party access.
Your one-time code
Each scan script contains a one-time code. The code works once and expires after 24 hours.
What we keep, and for how long
- We keep only summary numbers for each finding, not your raw ad data.
- Reports are deleted after 30 days.
- You can ask us to delete everything sooner by emailing support@spendcanary.com.
Removing the script
You can remove the script from your account at any time. Go back to the Scripts page, find it in the list, and remove it.
How to judge any Google Ads script
These tips apply to any script, from anyone, including us.
Read it before you run it. If it is too long or too hard to follow, ask someone you trust to look at it.
Look for calls that change things. Words like “mutate,” “apply,” “pause,” “remove,” or anything starting with “set,” such as “setBudget” or “setCpc,” mean the script can change your account. That is fine for a script you want to make changes. It is a warning sign for a script that claims to only read.
Check where data goes. Look for “UrlFetchApp” and the web address next to it. Make sure you know and trust that site. Be wary of scripts that send data to addresses you don’t recognize.
Use Preview first. Google lets you preview a script before running it. Preview shows the changes a script would make and its logs, without changing your account.
Watch for schedules. A script can be set to run on a schedule, like every hour or every day. Only schedule scripts you understand and want running long term.
Remove scripts you no longer use. Fewer scripts means fewer surprises later.