Five hundred slots sounds like plenty. Most advertisers never fill fifty. Then a real attack starts: a rival's contractor, a click farm hired against your top keywords, or a botnet that found your high-CPC auction, and the list fills in a week. Then the same question lands in every PPC forum: how do I exclude more than 500 IPs in Google Ads?
The short answer is you can't, and this guide is about what to do instead. It builds on our full breakdown of when IP exclusions work and when they fail; this post is specifically about the ceiling.
The Limit, Exactly
From Google's own IP exclusion documentation:
| Rule | Detail |
|---|---|
| Campaign cap | Up to 500 excluded IP addresses per campaign |
| Account-level exclusions | Supported under Admin, then Account settings; applies across the account |
| Ranges | Asterisk wildcard on the last section, for example 203.0.113.*; no CIDR notation |
| Unsupported at campaign level | Video, hotel, App, Performance Max, and Smart Display campaigns |
| Where to set it | Campaign, then Settings, then Additional settings, then IP exclusions |
| Effect | Stops future serving to those addresses; never refunds past clicks |
Three details in that table decide your strategy. A wildcard entry covers a full block of 256 addresses while spending one slot, so ranges are how you buy room. Campaign-level exclusions do not exist for Performance Max, so the account-level list is your only IP lever there. And exclusions are forward-looking only, so anything already billed goes through the dispute process instead.
Why 500 Runs Out Faster Than You Think
The cap was designed for a world where an offender had one office and one address. That world is gone. The modern attacker rents infrastructure:
- Residential proxy networks route clicks through real household connections. The large pools advertise millions of addresses across every country and carrier. A campaign of a few thousand hostile clicks can arrive from a few thousand distinct IPs, each used once or twice. We cover why this defeats static blocking in residential proxies and click fraud.
- Carrier-grade NAT puts thousands of mobile users behind one shared address. Block it and you block real customers with it; don't block it and the offender keeps riding through.
- Botnets and infected devices click from ordinary home computers whose addresses change with every DHCP lease.
Do the math against a 500-slot list. If an attack burns 200 fresh IPs a day and you update exclusions twice a week, you are permanently 600 addresses behind by the weekend, and the entries you added last month now point at reassigned addresses that may belong to real prospects. The list decays at both ends at once.
Six Ways to Stretch the Limit
Manual management still matters, especially against small and mid-sized offenders. These six moves get the most out of the 500 slots:
- Consolidate singles into wildcard ranges. If 30 entries share the first three sections, replace them with one
x.y.z.*entry and free 29 slots. Only do this when the whole block shows hostile behavior; a wildcard on a shared network trades fraud for lost customers. - Move permanent offenders to the account level. A competitor's confirmed office network belongs on the account-level list, where it also covers Performance Max and other campaign types that lack the campaign setting. Keep campaign slots for the active, rotating threat.
- Prune by date, not by memory. IPs get reassigned constantly. Log the date and evidence for every entry, and re-verify anything older than 60 to 90 days. A stale exclusion is a slot wasted on an address that now belongs to someone else.
- Cut exposure upstream so fewer IPs need blocking. Tighten location settings to Presence, trim ad schedules away from hostile hours, and apply shared exclusion lists for placements. Fewer hostile impressions means a slower-filling list.
- Keep an evidence file alongside the list. The same timestamps, IPs, and patterns that justify an exclusion also power a credit claim and, if it comes to it, a competitor case. One log, three uses.
- Review weekly, not annually. A 15-minute weekly pass (new repeat sources in, stale entries out) keeps a manual list useful. A list nobody maintains is just 500 slots of false confidence.
The Math That Never Works
Stretching helps, but be honest about where it ends. Every manual IP defense shares three structural flaws no amount of diligence fixes:
- You block yesterday. An exclusion is applied after the clicks that identified the offender were already billed. Against rotation, every new address gets its free bites first.
- The list can't learn. The same attacker on a new IP is, to your list, a brand-new stranger. Nothing carries over: not the device, not the behavior, not the history.
- Precision decays. As entries age, the risk flips from under-blocking to over-blocking, because one IP is not one person. Shared and reassigned addresses mean an old list quietly turns away real buyers.
That's why the teams that hit the 500 cap twice rarely try to win the list-management game a third time.
What Actually Beats the Limit
The structural answer is to stop keying the defense on the address and key it on the actor:
- Device fingerprinting recognizes the same machine across IP changes, so the offender who rotates addresses is still one known device.
- Behavioral scoring judges each click by how it acts (session depth, timing, interaction, automation signals), which catches the first click from a never-seen address, not just repeat visits.
- Automated exclusion sync turns those verdicts into Google Ads exclusions in real time, managing the 500 slots for you: adding active threats, consolidating ranges, and retiring stale entries without anyone maintaining a spreadsheet.
That combination is exactly how ClickFortify protects Google Ads accounts, with an evidence trail attached to every block so your dispute filings and competitor cases write themselves. See how ClickFortify works, and if you want to size the problem first, run your numbers through the ad fraud calculator.
If You're Hitting 500, Read This Part
Filling a campaign's exclusion list is diagnostic. It means the invalid traffic targeting you is industrial, not casual, and two follow-ups matter more than freeing slots:
- File for credits now, not later. The 60-day window on invalid traffic investigations is hard. If the attack has been running for weeks, part of the recoverable spend is already expiring.
- Check whether the pattern points somewhere. Hostile volume concentrated on your head terms during business hours reads differently from a diffuse botnet. Our competitor click fraud evidence guide shows how to tell them apart, and bot detection techniques covers the automated side.
The Bottom Line
The 500 IP exclusion limit in Google Ads is real, fixed, and smaller than it looks once a genuine attack starts. Stretch it intelligently: wildcards for ranges, the account-level list for permanent offenders, dated entries pruned on a schedule, and tighter targeting upstream. But treat the cap as a message. IP lists were built for an internet of static addresses, and the fraud you're fighting doesn't live there anymore. When the list fills, the upgrade isn't a bigger list. It's a defense that recognizes the actor instead of the address, blocks in real time, and keeps the evidence for the money you're owed.
