Docs
Monitor and Block
How enforcement is decided, what the tag does in each mode, and how a change you make in the dashboard reaches pages that are already open.
What do Off, Monitor and Block mean?
They are the three enforcement states, set per Site and per policy. Off means the tag does not start: it reads its configuration and returns before installing a single hook. Monitor means detect and report only — nothing on the page is changed: PubTrust watches, judges and reports every violation, and no creative is hidden, replaced or torn down. Block means a violating creative is hidden before paint, replaced with your fallback creative and torn down. Every new Site starts in Monitor.
How do the Site mode and a policy mode combine?
The Site mode is a ceiling. A creative is blocked only when the Site is in Block and the policy that fired is in Block. A policy can be more conservative than its Site — Monitor on a Site that blocks — but a policy can never block on a Site that is only monitoring. That makes switching a whole Site back to Monitor a reliable way to stop all policy blocking at once.
What exactly happens in Monitor?
Every detection is recorded as a flagged violation and sent in a violation beacon with its full record — pack, rule kind, matched value, weight, layer, advertiser domain, creative ID, bidder, slot and landing URL — and it is counted in the page view's summary beacon. No policy detection hides, replaces or tears down a creative.
Runtime Integrity in Monitor
Runtime Integrity is detect and report only in Monitor as well. Its hooks still observe a window.open call with no genuine user gesture in the previous 1 second or a second window from one gesture, a document.write after the page has finished loading, a script-synthesised click on a link targeting the top or parent frame, and media that starts playing unmuted without a gesture. Each is recorded as a flagged violation, and the call then proceeds exactly as it would without PubTrust. The iframe sandbox attribute is never injected on a monitoring Site.
On a Site in Block, the same hooks act: the window is not opened, the write is refused, the click is cancelled, the media is muted and — where the Site has opted in — ad iframes are sandboxed. Each protection is a separate per-Site setting.
What happens when a creative is blocked?
Suppression comes first, in the same callback that found the violation. At start-up the tag injects one stylesheet rule, [data-pt-blocked]{visibility:hidden!important;pointer-events:none!important}; a block then only has to set that attribute, so the creative never becomes visible and the slot keeps its box. The tag then measures the slot, overlays the fallback creative at those dimensions, and tears the creative down: every iframe in it is pointed at about:blank and removed, so it stops executing.
Creatives PubTrust renders itself
Where you hand PubTrust the creative markup to render, blocking happens before the creative has executed at all: the markup is held as inert text, judged, and on a block discarded in favour of your fallback. See inert-park.
Pre-render verdicts
A Layer 1 verdict usually arrives before the creative has any element on the page. On a blocking Site it is parked against the slot ID and enforced the moment the creative appears in that slot. The parked verdict is consumed when it is used, so a refreshed slot is judged on its own merits. The violation is reported as soon as the verdict is reached, so it appears in your feed even if the ad never renders.
How quickly does a mode change reach my pages?
Open pages pick it up at their next configuration poll. A running tag polls its configuration every 5 minutes and applies a changed Site mode, or a new policy bundle, without a reload; the configuration response is cached at the edge for 60 seconds. New page views receive the tag with the current configuration once the edge's cached copy expires — the tag is served with max-age=60, s-maxage=300. A Site switched to Off stops initialising on new page views, and in pages already open the polled mode stops all policy blocking.
What does the remote kill switch do?
When a Site is killed, the next configuration poll tells every running copy of its tag to stand down: the tag stops polling, removes every hook, listener, observer, stylesheet and overlay it installed, in reverse order, and reports the reason with the page view's summary beacon. Inactive or unknown tag keys are served a valid script that does nothing.
When should I switch a policy to Block?
When a week or two of Monitor data from your own inventory has convinced you, and one policy at a time. The install guide's rollout sequence sets out the order we recommend, starting with Malware & Scam and Runtime Integrity.