diff --git a/src/app/blog/BlogAd.jsx b/src/app/blog/BlogAd.jsx
new file mode 100644
index 0000000..e07dcf3
--- /dev/null
+++ b/src/app/blog/BlogAd.jsx
@@ -0,0 +1,39 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import Script from 'next/script';
+import { useAuthStore } from '@/lib/stores/auth.js';
+
+// Standard CrawlProof ad snippet (data-cp-ad + ad.js), shown only to logged-out
+// visitors on /blog/*. The auth store hydrates from localStorage on the client,
+// so we wait for mount + the initial `loading` to settle before deciding, to
+// avoid flashing an ad at a signed-in user. On client-side navigation ad.js may
+// already be loaded, so we re-trigger its slot scan once shown.
+export default function BlogAd() {
+ const [mounted, setMounted] = useState(false);
+ const user = useAuthStore((s) => s.user);
+ const loading = useAuthStore((s) => s.loading);
+
+ useEffect(() => {
+ setMounted(true);
+ }, []);
+
+ const show = mounted && !loading && !user;
+
+ useEffect(() => {
+ if (show && typeof window !== 'undefined') {
+ window.crawlproofAds?.scan?.();
+ }
+ }, [show]);
+
+ if (!show) return null;
+
+ return (
+ <>
+
-
+ {/* Primary: standard CrawlProof snippet via ad.js, logged-out visitors only. */}
+
+ {/* No-JS fallback — renders only when JavaScript is disabled (e.g. Tor
+ Safest mode / .onion). A plain cross-origin iframe that renders and is
+ clickable with zero script. Auth can't be checked without JS, so it
+ shows to all no-JS visitors, which is fine for a public blog. */}
+
);
}