Verifying yourself on Mastodon is quite simple: just add the following to the <head> tag of your website:

<link rel="me" href="https://mastodon.instance/@username"/>

Then, add your website to your Mastodon profile, and you should be good to go.

That wasn’t the case for me.

I added the above link to the header—nothing. I added it to the footer—still nothing. I even tried adding the <a rel="me"...>version as a navigation link in both the top and bottom menus. No luck.

I left it overnight. Still no change.

Then I thought: If I’ve added my website to my Mastodon profile, I should at least see a Mastodon user-agent in the Apache logs. So, I re-added the website to my profile and checked again. Nothing.

Huzzah! A clue.

A quick check in Cloudflare revealed the issue: I had enabled Bot Fight Mode. I disabled it, checked the Apache logs again, and immediately saw Mastodon requests:

[10/Jul/2025:14:22:51 +0000] "GET /wp-json/activitypub/1.0/actors/0/followers HTTP/1.1" 200 4251 "-" "Mastodon/4.4.1 (http.rb/5.3.1; +https://indieweb.social/)"

Shortly after that, my website was verified.