From b1d954a94fc1ecf0e6d37af809fe76e297adc046 Mon Sep 17 00:00:00 2001
From: "crawlproof[bot]" <286981042+crawlproof[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:56:09 +0000
Subject: [PATCH 1/5] Add CrawlProof ad unit

---
 src/app/layout.jsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/app/layout.jsx b/src/app/layout.jsx
index 4f88c86..814ecf5 100644
--- a/src/app/layout.jsx
+++ b/src/app/layout.jsx
@@ -99,7 +99,9 @@ export default function RootLayout({ children }) {
       <body suppressHydrationWarning>
         <ClientLayout>{children}</ClientLayout>
               <Script data-site="38c4083a-a35e-435d-8a0e-3510c465f419" src="https://crawlproof.com/stats.js" strategy="afterInteractive" />
-      <FeedbackWidget /></body>
+      <FeedbackWidget />        <div data-cp-ad="" data-slot="4a5b5f93-ebd9-4d02-b927-05544fdeb81e" data-format="banner_300x250" />
+      <Script src="https://crawlproof.com/ad.js" strategy="afterInteractive" />
+      </body>
     </html>
   );
 }

From 208130005fddade7c932915eb4b46ce75f9fdf4f Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Tue, 7 Jul 2026 11:00:52 +0000
Subject: [PATCH 2/5] Scope crawlproof ad to /blog/* for logged-out users only

Revert the all-pages ad injection in the root layout; render the banner
via a client-gated BlogAd component inside the blog layout so it only
shows on /blog/* and never to signed-in users.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/app/blog/BlogAd.jsx | 39 +++++++++++++++++++++++++++++++++++++++
 src/app/blog/layout.jsx |  7 ++-----
 src/app/layout.jsx      |  4 +---
 3 files changed, 42 insertions(+), 8 deletions(-)
 create mode 100644 src/app/blog/BlogAd.jsx

diff --git a/src/app/blog/BlogAd.jsx b/src/app/blog/BlogAd.jsx
new file mode 100644
index 0000000..243b617
--- /dev/null
+++ b/src/app/blog/BlogAd.jsx
@@ -0,0 +1,39 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import Script from 'next/script';
+import { useAuthStore } from '@/lib/stores/auth.js';
+
+// CrawlProof banner, shown only to logged-out visitors on /blog/*. The auth
+// store hydrates from localStorage on the client, so we wait for mount + the
+// initial `loading` to settle before deciding, to avoid flashing an ad at a
+// signed-in user. On client-side navigation ad.js may already be loaded, so we
+// re-trigger its slot scan once mounted.
+export default function BlogAd() {
+  const [mounted, setMounted] = useState(false);
+  const user = useAuthStore((s) => s.user);
+  const loading = useAuthStore((s) => s.loading);
+
+  useEffect(() => {
+    setMounted(true);
+  }, []);
+
+  const show = mounted && !loading && !user;
+
+  useEffect(() => {
+    if (show && typeof window !== 'undefined') {
+      window.crawlproofAds?.scan?.();
+    }
+  }, [show]);
+
+  if (!show) return null;
+
+  return (
+    <>
+      <div className="container" style={{ maxWidth: '48rem', margin: '0 auto', padding: '1.5rem 0', display: 'flex', justifyContent: 'center' }}>
+        <div data-cp-ad data-slot="4a5b5f93-ebd9-4d02-b927-05544fdeb81e" data-format="banner_300x250"></div>
+      </div>
+      <Script src="https://crawlproof.com/ad.js" strategy="afterInteractive" />
+    </>
+  );
+}
diff --git a/src/app/blog/layout.jsx b/src/app/blog/layout.jsx
index c9cfcce..374fb8d 100644
--- a/src/app/blog/layout.jsx
+++ b/src/app/blog/layout.jsx
@@ -1,13 +1,10 @@
-import Script from 'next/script';
+import BlogAd from './BlogAd.jsx';
 
 export default function BlogLayout({ children }) {
   return (
     <>
       {children}
-      <div className="container" style={{ maxWidth: '48rem', margin: '0 auto', padding: '1.5rem 0', display: 'flex', justifyContent: 'center' }}>
-        <div data-cp-ad data-slot="4a5b5f93-ebd9-4d02-b927-05544fdeb81e" data-format="banner_300x250"></div>
-      </div>
-      <Script src="https://crawlproof.com/ad.js" strategy="afterInteractive" />
+      <BlogAd />
     </>
   );
 }
diff --git a/src/app/layout.jsx b/src/app/layout.jsx
index 814ecf5..4f88c86 100644
--- a/src/app/layout.jsx
+++ b/src/app/layout.jsx
@@ -99,9 +99,7 @@ export default function RootLayout({ children }) {
       <body suppressHydrationWarning>
         <ClientLayout>{children}</ClientLayout>
               <Script data-site="38c4083a-a35e-435d-8a0e-3510c465f419" src="https://crawlproof.com/stats.js" strategy="afterInteractive" />
-      <FeedbackWidget />        <div data-cp-ad="" data-slot="4a5b5f93-ebd9-4d02-b927-05544fdeb81e" data-format="banner_300x250" />
-      <Script src="https://crawlproof.com/ad.js" strategy="afterInteractive" />
-      </body>
+      <FeedbackWidget /></body>
     </html>
   );
 }

From e7b547963f21698a7b91ddf0a4a0f1ba2ecd7344 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Tue, 7 Jul 2026 11:34:23 +0000
Subject: [PATCH 3/5] Serve blog ad via no-JS iframe instead of ad.js

Render the CrawlProof banner as a plain cross-origin <iframe> pointing at
the new /api/ads/frame endpoint rather than the data-cp-ad + ad.js path.
The ad now renders and follows through to the destination without ad.js,
and the click link lives inside CrawlProof's own document so the PWA's JS
(visibility handlers, service worker) can't interrupt the click-through.
Still gated to logged-out visitors on /blog/*.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/app/blog/BlogAd.jsx | 49 +++++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 21 deletions(-)

diff --git a/src/app/blog/BlogAd.jsx b/src/app/blog/BlogAd.jsx
index 243b617..f8ae707 100644
--- a/src/app/blog/BlogAd.jsx
+++ b/src/app/blog/BlogAd.jsx
@@ -1,14 +1,23 @@
 'use client';
 
 import { useEffect, useState } from 'react';
-import Script from 'next/script';
 import { useAuthStore } from '@/lib/stores/auth.js';
 
-// CrawlProof banner, shown only to logged-out visitors on /blog/*. The auth
-// store hydrates from localStorage on the client, so we wait for mount + the
-// initial `loading` to settle before deciding, to avoid flashing an ad at a
-// signed-in user. On client-side navigation ad.js may already be loaded, so we
-// re-trigger its slot scan once mounted.
+// CrawlProof banner, shown only to logged-out visitors on /blog/*.
+//
+// The ad is a plain cross-origin <iframe> pointing at CrawlProof's server-
+// rendered HTML endpoint — NOT the data-cp-ad + ad.js path. That means it
+// renders and is clickable with no ad.js on the page, and the click link lives
+// inside CrawlProof's own document, so the PWA's own JS (visibility handlers,
+// service worker, etc.) can never intercept the click-through.
+//
+// The auth store hydrates from localStorage on the client, so we wait for mount
+// + the initial `loading` to settle before deciding, to avoid flashing an ad at
+// a signed-in user.
+const AD_SLOT = '4a5b5f93-ebd9-4d02-b927-05544fdeb81e';
+const AD_FORMAT = 'banner_300x250';
+const AD_SRC = `https://crawlproof.com/api/ads/frame?slot=${AD_SLOT}&format=${AD_FORMAT}`;
+
 export default function BlogAd() {
   const [mounted, setMounted] = useState(false);
   const user = useAuthStore((s) => s.user);
@@ -18,22 +27,20 @@ export default function BlogAd() {
     setMounted(true);
   }, []);
 
-  const show = mounted && !loading && !user;
-
-  useEffect(() => {
-    if (show && typeof window !== 'undefined') {
-      window.crawlproofAds?.scan?.();
-    }
-  }, [show]);
-
-  if (!show) return null;
+  if (!mounted || loading || user) return null;
 
   return (
-    <>
-      <div className="container" style={{ maxWidth: '48rem', margin: '0 auto', padding: '1.5rem 0', display: 'flex', justifyContent: 'center' }}>
-        <div data-cp-ad data-slot="4a5b5f93-ebd9-4d02-b927-05544fdeb81e" data-format="banner_300x250"></div>
-      </div>
-      <Script src="https://crawlproof.com/ad.js" strategy="afterInteractive" />
-    </>
+    <div className="container" style={{ maxWidth: '48rem', margin: '0 auto', padding: '1.5rem 0', display: 'flex', justifyContent: 'center' }}>
+      <iframe
+        src={AD_SRC}
+        title="Advertisement"
+        width={300}
+        height={250}
+        scrolling="no"
+        loading="lazy"
+        referrerPolicy="no-referrer-when-downgrade"
+        style={{ border: 0, width: 300, height: 250, maxWidth: '100%' }}
+      />
+    </div>
   );
 }

From aac901d593f49e1c3fa256cd9d76883e53d68896 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Tue, 7 Jul 2026 11:38:17 +0000
Subject: [PATCH 4/5] Revert blog ad to standard data-cp-ad + ad.js integration

Keep the stock CrawlProof snippet (data-cp-ad div + ad.js) rather than a
custom iframe; only retain the /blog/* scoping and logged-out gating.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/app/blog/BlogAd.jsx | 49 ++++++++++++++++++-----------------------
 1 file changed, 21 insertions(+), 28 deletions(-)

diff --git a/src/app/blog/BlogAd.jsx b/src/app/blog/BlogAd.jsx
index f8ae707..e07dcf3 100644
--- a/src/app/blog/BlogAd.jsx
+++ b/src/app/blog/BlogAd.jsx
@@ -1,23 +1,14 @@
 'use client';
 
 import { useEffect, useState } from 'react';
+import Script from 'next/script';
 import { useAuthStore } from '@/lib/stores/auth.js';
 
-// CrawlProof banner, shown only to logged-out visitors on /blog/*.
-//
-// The ad is a plain cross-origin <iframe> pointing at CrawlProof's server-
-// rendered HTML endpoint — NOT the data-cp-ad + ad.js path. That means it
-// renders and is clickable with no ad.js on the page, and the click link lives
-// inside CrawlProof's own document, so the PWA's own JS (visibility handlers,
-// service worker, etc.) can never intercept the click-through.
-//
-// The auth store hydrates from localStorage on the client, so we wait for mount
-// + the initial `loading` to settle before deciding, to avoid flashing an ad at
-// a signed-in user.
-const AD_SLOT = '4a5b5f93-ebd9-4d02-b927-05544fdeb81e';
-const AD_FORMAT = 'banner_300x250';
-const AD_SRC = `https://crawlproof.com/api/ads/frame?slot=${AD_SLOT}&format=${AD_FORMAT}`;
-
+// Standard CrawlProof ad snippet (data-cp-ad + ad.js), shown only to logged-out
+// visitors on /blog/*. The auth store hydrates from localStorage on the client,
+// so we wait for mount + the initial `loading` to settle before deciding, to
+// avoid flashing an ad at a signed-in user. On client-side navigation ad.js may
+// already be loaded, so we re-trigger its slot scan once shown.
 export default function BlogAd() {
   const [mounted, setMounted] = useState(false);
   const user = useAuthStore((s) => s.user);
@@ -27,20 +18,22 @@ export default function BlogAd() {
     setMounted(true);
   }, []);
 
-  if (!mounted || loading || user) return null;
+  const show = mounted && !loading && !user;
+
+  useEffect(() => {
+    if (show && typeof window !== 'undefined') {
+      window.crawlproofAds?.scan?.();
+    }
+  }, [show]);
+
+  if (!show) return null;
 
   return (
-    <div className="container" style={{ maxWidth: '48rem', margin: '0 auto', padding: '1.5rem 0', display: 'flex', justifyContent: 'center' }}>
-      <iframe
-        src={AD_SRC}
-        title="Advertisement"
-        width={300}
-        height={250}
-        scrolling="no"
-        loading="lazy"
-        referrerPolicy="no-referrer-when-downgrade"
-        style={{ border: 0, width: 300, height: 250, maxWidth: '100%' }}
-      />
-    </div>
+    <>
+      <div className="container" style={{ maxWidth: '48rem', margin: '0 auto', padding: '1.5rem 0', display: 'flex', justifyContent: 'center' }}>
+        <div data-cp-ad data-slot="4a5b5f93-ebd9-4d02-b927-05544fdeb81e" data-format="banner_300x250"></div>
+      </div>
+      <Script src="https://crawlproof.com/ad.js" strategy="afterInteractive" />
+    </>
   );
 }

From ae679f36636858cf1add0f031b8266eae63f7b99 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Tue, 7 Jul 2026 11:43:38 +0000
Subject: [PATCH 5/5] Add <noscript> iframe fallback for the blog ad

Keep the standard data-cp-ad + ad.js snippet as the primary path; add a
no-JS <noscript> fallback that renders the plain /api/ads/frame iframe so
the ad still shows and is clickable when JavaScript is disabled (Tor
Safest mode, .onion). Exactly one path renders per visitor.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/app/blog/layout.jsx | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/app/blog/layout.jsx b/src/app/blog/layout.jsx
index 374fb8d..b22b96b 100644
--- a/src/app/blog/layout.jsx
+++ b/src/app/blog/layout.jsx
@@ -1,10 +1,31 @@
 import BlogAd from './BlogAd.jsx';
 
+const AD_SLOT = '4a5b5f93-ebd9-4d02-b927-05544fdeb81e';
+const AD_FORMAT = 'banner_300x250';
+const AD_WRAP = { maxWidth: '48rem', margin: '0 auto', padding: '1.5rem 0', display: 'flex', justifyContent: 'center' };
+
 export default function BlogLayout({ children }) {
   return (
     <>
       {children}
+      {/* Primary: standard CrawlProof snippet via ad.js, logged-out visitors only. */}
       <BlogAd />
+      {/* No-JS fallback — renders only when JavaScript is disabled (e.g. Tor
+          Safest mode / .onion). A plain cross-origin iframe that renders and is
+          clickable with zero script. Auth can't be checked without JS, so it
+          shows to all no-JS visitors, which is fine for a public blog. */}
+      <noscript>
+        <div className="container" style={AD_WRAP}>
+          <iframe
+            src={`https://crawlproof.com/api/ads/frame?slot=${AD_SLOT}&format=${AD_FORMAT}`}
+            title="Advertisement"
+            width={300}
+            height={250}
+            scrolling="no"
+            style={{ border: 0, width: 300, height: 250, maxWidth: '100%' }}
+          />
+        </div>
+      </noscript>
     </>
   );
 }
