diff --git a/Caddyfile b/Caddyfile
index 1706523..b66634b 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -34,7 +34,7 @@
 		X-Frame-Options "DENY"
 		Referrer-Policy "strict-origin-when-cross-origin"
 		Permissions-Policy "camera=(), microphone=(), geolocation=(), browsing-topics=()"
-		Content-Security-Policy "default-src 'self'; script-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; connect-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"
+		Content-Security-Policy "default-src 'self'; script-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; connect-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-src 'self' https://crawlproof.com; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"
 		-Server
 	}
 
diff --git a/apps/web/public/index.html b/apps/web/public/index.html
index 8b2c759..ce4a819 100644
--- a/apps/web/public/index.html
+++ b/apps/web/public/index.html
@@ -248,6 +248,16 @@ <h3>How do I install it?</h3>
       then <code>tron &lt;url&gt;</code>. Windows builds are on the
       <a href="https://github.com/profullstack/tronbrowser.dev/releases">releases page</a>.</p>
     </div>
+    <!-- CrawlProof ad: one script-free cross-origin frame (/api/ads/frame), not ad.js.
+         ad.js fills a srcdoc frame that inherits this page's CSP, and img-src 'self' would
+         blank the creative. text_link is the fluid format (40px at any width), so one unit
+         fits every viewport; it carries its own "Sponsored" mark. CSP cost: frame-src. -->
+    <aside class="cp-ad" aria-label="Advertisement" style="max-width:72rem;margin:2rem auto 0;padding:0 1rem">
+      <iframe src="https://crawlproof.com/api/ads/frame?slot=42d8cb56-9003-4a80-ab9b-17704a86714c&amp;format=text_link"
+        title="Advertisement" height="40" loading="lazy" scrolling="no"
+        style="display:block;width:100%;height:40px;border:0"
+        sandbox="allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation"></iframe>
+    </aside>
   </main>
 
   <div class="site-foot">