HTML5 Banner QC Checklist for Ad Ops and Agencies

A rejected creative costs a day of launch time and an awkward email to the client. Run every HTML5 ZIP through these twelve checks before it goes to Google Ads, Campaign Manager 360 or DV360. Each point names the rule, the platform it comes from, and how to check it. The HTML5 Banner Validator automates most of them.

The 12 point preflight QC checklist

1. index.html at the root. The primary file sits at the top level of the ZIP, not inside a folder. Zip the files, not the folder. See the missing primary asset fix.
2. ad.size tag in the head. <meta name="ad.size" content="width=300,height=250"> with the real dimensions, inside a closed <head>. Required by Google Ads, recommended by CM360, and checked against the images by DV360.
3. Weight within the platform limit. Google Ads: 600 KB ZIP. CM360: 9.5 MB ZIP. DV360: 5 MB downloaded when the ad serves. Over the limit? Follow how to compress HTML5 ZIP banners.
4. File count. Google Ads: 40 files. CM360 and DV360: 100. Remove __MACOSX, .DS_Store and source files.
5. Accepted file types only. Google Ads takes HTML, CSS, JS, GIF, PNG, JPG, JPEG and SVG. CM360 and DV360 also take fonts. No WebP, video or nested ZIPs anywhere.
6. clickTag declared and spelled right. var clickTag in the head of the primary HTML, exactly that casing, readable rather than minified. One exit for Google Ads, several allowed in CM360. See how to fix a missing clickTag.
7. No hardcoded landing page. Clicks call window.open(window.clickTag). A plain href="https://..." bypasses the ad server's click count.
8. External references allowed. Google Ads accepts only Google Fonts and Google's hosted CreateJS, GreenSock and jQuery, at the URLs in the Google Ads allowlist. Everything else is bundled.
9. Everything over HTTPS. No http:// asset, font, script or tracker. DV360 tests every creative for insecure calls during review. Where these links hide and how to fix them is below.
10. Animation stops within 30 seconds. Loops count toward the total. Animated GIFs for Google Ads also run slower than 5 FPS.
11. No local or session storage. CM360 and DV360 refuse HTML5 assets that use them, and the validator fails them in its Google Ads, CM360 and DV360 modes. Keep state in plain variables, as the storage section of the platform comparison explains.
12. Renders in a sandboxed frame. The creative plays, every image loads and the click lands on the clickTag inside an isolated iframe, the way an ad server delivers it. The HTML5 banner preview guide shows how to test it.

Before the checklist: confirm the booking

• Sizes. Every size on the media plan exists, and each canvas matches its ad.size tag. The banner ad sizes chart lists the standard dimensions, and the banner size templates give you a blank PNG and a starter ZIP for each.
• Platform. Know whether the ZIP goes to Google Ads, CM360 or DV360. The three do not share limits.
• Backup image. Optional for all three. On CM360 it is uploaded separately by the trafficker, not inside the ZIP.

Automating the checklist

Drop the whole campaign into the HTML5 Banner Validator with the right platform selected. Points 1 to 9 and 11 are checked automatically. Point 10 is measured for GIFs, while HTML5 animation length is best timed in the preview. Point 12 is the live preview next to each result, where clicks are intercepted and the clickTag value is shown. Export the CSV QA report and attach it to the delivery so the trafficker sees what was checked.

For the fixes: the clickTag Editor repairs point 6 inside the ZIP, the Banner Compressor handles point 3, and the clickTag Generator writes the ad.size and clickTag pair for every size in a campaign sheet. The Google Ads specific version of this list, with Google's exact error messages, is in the Google Ads HTML5 validator guide.

Point 9 in depth: fixing insecure http links

An SSL compliant banner loads every asset and every tracker over https://. One http:// image, font or pixel is enough to fail: DV360 will not accept an upload that loads a file from an http: link, and on a secure publisher page the browser blocks the insecure request as mixed content, which can leave the ad slot empty.

DV360 states the rule most clearly in About secure creatives: all assets and trackers must load from secure servers, and every URL should start with https except landing page URLs, which DV360 does not require to be SSL compliant. Each creative is tested for insecure calls during review, and a failure comes back with the offending URLs. The only exception it lists is creatives served in China. The AdCheckLab validator treats any http:// reference as an error in every mode, Google Ads, CM360, DV360 and Generic alike.

Where insecure links hide

• Script and stylesheet tags copied from an old template, for example a library loaded from http://ajax.googleapis.com.
• CSS url() values and @import rules pointing at a web font or background image.
• JavaScript strings that build image paths or fire tracking pixels at runtime.
• Third party trackers pasted in by a vendor. DV360 counts trackers the same as assets.
• Exported code from older versions of design tools, which sometimes hardcode http links to their own CDN.

How to fix them

Search every HTML, CSS and JS file in the build for "http://" and change each hit to "https://". For example, change:

<script src="http://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>

to:

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>

If a host does not answer over https, it cannot be used in an ad: bundle the file into the ZIP instead. On Google Ads that is required anyway for anything outside the allowlist. Prefer explicit https:// over protocol relative URLs such as //ajax.googleapis.com. They inherit the page's scheme, which hides the problem when you test locally.

What the validator does and does not flag

The validator scans every quoted http:// URL in the ZIP's HTML, CSS and JavaScript, skipping comments, and reports up to three of them in Insecure HTTP Connections. Two things are deliberately not counted, because they never load over the network: XML namespace identifiers such as the SVG namespace, and the default value of a clickTag declaration, which the ad server replaces at serve time. Write that default with https anyway. A clean build shows SSL / HTTPS Compliance in the passed list. If it passes but still renders empty, work through why a banner preview is blank.