The Meta Trusted Domains feature helps you protect your ad accounts by identifying unauthorized or suspicious domains running ads under your ad accounts.

This tool gives you full visibility and control over which domains are allowed to run ads — helping you quickly detect potential hacks, asset misuse, or unauthorized campaign activity.

What Is Meta Trusted Domains?

Meta Trusted Domains is a security layer that:

• Tracks all domains running ads on your ad accounts
• Detects new or unknown domains automatically
• Lets you mark safe domains as Trusted
• Helps you identify suspicious activity early

If a domain you don’t recognize starts appearing in campaigns, it may indicate:

• A compromised ad account
• Unauthorized access
• A misconfigured campaign
• Compromised profile or BM
• Domain misuse by a third party

How Domains Are Added to the List

Domains can appear in your Trusted Domains list from four different sources:

1. Request Domain

When you request a new ad account, the website/domain you submit is automatically added to your trusted domains list.

• Source: Request
• Purpose: Ensures your primary business domain is always allowed

2. Added by Admin

Our internal team may add domains on your behalf.

This usually happens when:

• Assisting with setup or migration
• Whitelisting domains for compliance reasons
• Helping secure your ad account
• Source: Admin

3. Added by You (Manual Add)

You can manually add domains using the “Add New Domain” button.

Use this when:

• You own multiple domains
• You’re testing new landing pages
• You want to pre-approve domains before campaigns go live
• Source: User

4. Detected (Auto-Detected From Active Ads)

Our system automatically detects domains that are actively running ads on your ad accounts using our APIs.

These domains appear under the Detected section and include detailed context such as:

• Which ad account the domain is running on
• Campaign name
• Ad set name
• Ad ID

This is the most important security signal, as it shows what is actually live.

• Source: Detected

Domain Status: Trusted vs Untrusted

Each domain in the list has a Status field.

Marking a Domain as Trusted

When you mark a domain as Trusted:

• It is added to your allowlist
• It is considered safe to run ads on your ad accounts
• Future detections of this domain are treated as expected behavior

You should only mark a domain as Trusted if:

• You own the domain
• You intentionally run ads on it
• You trust its usage

Unauthorized / Suspicious Domains

If a domain appears that:

• You don’t recognize
• You no longer control
• You didn’t approve

This could indicate:

• Compromised access
• A hacked ad account
• A malicious campaign

In such cases:

• Do not mark it as Trusted
• Investigate immediately
• Contact support if needed

Deleting a Domain

You can remove a domain from the list using the Delete button.

You should delete a domain if:

• You no longer own or control it
• Access to the domain is lost
• It should no longer be allowed to run ads

Monitoring & Alerts

The dashboard also shows:

• Total trusted domains
• Unauthorized domains detected
• Monitored ad accounts
• Last scan time (auto/manual)

Summary

• Meta Trusted Domains helps prevent unauthorized ad activity
• Domains can be added automatically, by admin, by you, or via detection
• Detected domains show live campaign usage details
• Only mark domains as Trusted if you fully control them
• Deleting domains helps maintain security visibility
• Deleted domain does not mean deleting campaign. You need to do that manually

Updated on: 03/02/2026