Four times. That is how many times Google AdSense has looked at this blog and come back with “low value content”. I set the site up quickly, let AI do most of the typing, published a hundred posts between June and late August, and ended up with something that neither Google nor a human reader had any reason to trust. The setup was the easy part and I got it mostly right. The publishing is where I went wrong.
So this is not a generic “start a blog in 2026” guide. It is the walkthrough of this exact site: what it runs on, in what order I did it, what the AI did and could not do, and what was still wrong a hundred posts later.
What this blog actually runs on
Nothing exotic. WordPress on a Hostinger shared plan, the theme that came with Hostinger’s own onboarding flow, two plugins, and a text file. That is the whole stack:
- WordPress, installed from the hosting panel rather than by hand. Five minutes.
- A block theme from Hostinger’s setup wizard. I have since changed the header, the footer and the single-post template, but I never picked a “premium” theme and I do not think I needed one.
- All in One SEO (AIOSEO) for titles, meta descriptions and the sitemap at
/sitemap.xml. - Google Site Kit, which is how the Analytics and AdSense snippets get into the page without me editing the theme.
- ads.txt in the root of the domain, one line long.
A shared plan, in other words: the cheapest thing that runs WordPress properly. The only buying advice I will give here is that the advertised price is an entry price on a multi-year term and the renewal is a different, larger number, so budget for the renewal rather than the headline. I keep hosting comparisons on a separate site and the cost breakdown for this one in the full inventory of this blog’s stack.
What that setup gives you, before you configure anything, is worth knowing in detail, because most walkthroughs stop at “install WordPress” and never tell you what you have actually got. On 20 September 2026 I read my own site’s response headers and certificate with curl and openssl, from my home connection in Valencia, Spain. This is what a default install on shared hosting was serving that day:
| vireltify.com, checked 20 September 2026 | What it was serving |
|---|---|
| Server and backend | LiteSpeed, PHP 8.3.33 |
| Page-cache header | None present. Every request built the page from scratch |
| HTTPS certificate | Let’s Encrypt, expiring 26 October 2026, renewed by the host |
| HSTS (Strict-Transport-Security) | Not sent |
| HTTP/2 | Negotiated, confirmed by checking ALPN with openssl |
| HTTP/3 | Advertised in the alt-svc header. I did not test whether it works |
| Home page HTML | 99,141 bytes, served as 26,324 bytes with Brotli |
Two of those rows are things I should have noticed on day one. There is no page-cache header, which means I never installed a caching plugin, and no HSTS header, which means the browser is not told to stick to HTTPS. Neither is the host’s fault and neither is a disaster on a small blog. But I found both by measuring, not by asking, and that is the honest lesson of the setup phase: the parts nobody configures are invisible until you look at the response yourself.
The first afternoon, in order
- Domain and hosting. Bought together, which makes the DNS a non-issue: the host creates the records for you and HTTPS comes with a free Let’s Encrypt certificate that renews itself. I have never had to touch it on the shared plan. On my own VPS, where I manage the certificate myself, it has broken more than once.
- WordPress, then permalinks. Settings, Permalinks, post name. Do it before you publish anything, not after. Changing URLs later means redirects, and redirects mean work.
- Site title and tagline. Write them once and use the same wording in the theme, the About page and the footer. Mine disagreed with itself for months. Small, but it is the kind of detail that tells a reviewer nobody is home.
- AIOSEO. Run the wizard, then check that the sitemap URL actually loads.
- Site Kit. Connect Search Console first, Analytics second, AdSense last.
- The legal pages. The part everyone leaves for later, including me.
One thing I skipped in that first afternoon cost me more than anything else on the list: the mailbox. The contact page advertised an address at my own domain, but the domain had no MX record, so every message sent to it bounced. For months, the address on the contact page swallowed everything sent to it. If you publish an email, send yourself a test message from a different account before you call it done.
What the AI did, and what it could not do
I build and edit my sites with an AI coding assistant, and I am not going to pretend otherwise. On the setup, it was genuinely useful for four things: drafting the first version of the legal pages, writing the theme template edits I did not want to look up, generating the redirect rules when I moved URLs around, and going through a hundred posts far faster than I ever could by hand.
What it could not do is anything that required knowing my situation. It did not know that my domain had no MX record. It did not know what I had actually paid, which hosts I had actually used, or that the product I was promoting in every post was listed at a different price on the store page than in the article. It cannot check those things, and it will not stop you publishing while they are wrong. I go into the code side of this in more detail in my write-up on how I use AI coding assistants on my own sites.
The drafting side has the same shape. An assistant will give you a competent, structurally correct article about almost anything in thirty seconds. What it cannot give you is the one sentence that makes the article worth reading, because that sentence is usually a number you measured, a mistake you made, or a price you paid. My working method for that is in how I draft with AI now, brief first.
The legal and advertising pages, and why they are not optional
If you intend to show ads, some of this is a requirement rather than good manners.
- Privacy policy. AdSense requires specific content, including the passage about third-party vendors using cookies and how visitors opt out. The requirements are written out in Google’s page on required content. A 280-word template that you also used on another site does not cover it, which is exactly what I had.
- A consent message for the EEA, the UK and Switzerland. To serve personalised ads to visitors there, Google requires a certified consent management platform integrated with the IAB TCF. The free option is the European regulations message inside AdSense itself. This blog had no consent banner of any kind, which is a policy problem, not a style problem.
- A legal notice with a real name behind it. I am in Spain, and a site with advertising revenue has to identify its owner. More generally: an anonymous site that writes in “we” and reviews tools it has never opened is the single most common profile of a rejected application.
- ads.txt in the root of the domain. One line, in this shape:
google.com, pub-XXXXXXXXXXXXXXXX, DIRECT, f08c47fec0942fa0Check it by loading /ads.txt in a private window. Mine was the one thing on this list I got right from day one.
The last step is Search Console: submit the full sitemap URL, delete any old or broken sitemap entries, and request indexing for the pages you care about. That routine, and how long it realistically takes to see anything, is in the checklist I run to get a new site into Google.
If the plan is an affiliate site
Plenty of people set up a blog specifically to earn commissions, so it is worth saying what that adds, from the position of someone approved in no programme at all.
You need approval, and approval is not automatic. Programmes look at the site before they accept it, which means the content has to exist first. You need disclosure close to the link, not buried in a footer, which is what the US Federal Trade Commission’s endorsement guides are about. And you need the link marked up properly, with rel="sponsored nofollow", as Google’s guidance on qualifying outbound links describes.
What I had instead was the worst of both worlds: buttons that announced a commission, carried no tracking ID at all, and pointed at the vendor’s home page. They earned nothing and they made the site look decorated rather than monetised. Until I am approved somewhere, links out of this site are plain rel="nofollow" links with nothing appended, including the ones in this post.
What the setup did not save me from
Everything above is the part you can finish in an afternoon and tick off. Here is what was still wrong a hundred posts later, all of it found by exporting my own site through the WordPress REST API and counting:
- Nobody was behind it. The site spoke as “we”, the About page described “an independent publication”, and the only name anywhere was my WordPress login, leaking out through the REST API. An anonymous site reviewing things in the first person plural is the profile reviewers are trained to distrust, and they are right to.
- No consent banner at all. The advertising code was on the page and nothing asked European visitors for consent. That is not a detail you fix after approval; it is a requirement.
- The brand could not agree with itself. Lowercase in one place, capitalised in another, an Open Graph site name that ended in a stray dash, menu items with inconsistent capitals, and seven tags that had exactly one post each.
- 211 of 212 images had no alt text, and 57 posts had no internal link to anywhere on the site. Both are five-minute habits that I simply never started.
And then the content itself, which is the real story and too long for this post: a hundred articles produced on a template, thirty-six of them published on a single day, promotional boxes in every one of them and claims about testing that never happened. I have written that up properly, with the counts and what I changed, in a post that counts every one of those mistakes.
The order I would use now
- Hosting, WordPress, permalinks, HTTPS. One afternoon.
- A working mailbox on the domain, tested from outside.
- About, contact, privacy, cookies, legal notice, and a page saying how the content is made. Before any post.
- Five posts you could defend to someone who works in the field, published over five weeks.
- Search Console, sitemap, indexing requests. Then wait, because there is nothing to speed up.
- Ads and affiliate programmes last, once there is something on the site worth putting them next to.
Steps one and two take an afternoon and everyone gets them right. Step four is the whole job, and it is the one AI makes feel optional. It is not.
Sources
- AdSense: required content for a privacy policy.
- Google consent management requirements for the EEA, UK and Switzerland.
- AdSense ads.txt guide.
- Headers, certificate and HTML sizes: my own readings of 20 September 2026, described above.