Paying for a domain is not evidence of controlling it. Anyone can type any hostname into a checkout form, so before we publish files that are served at your domain, we ask you to show the domain back to us. This protects you as much as anyone: it is the reason nobody else can buy hosting for a domain you run and have us serve their files from it.
When you need it
Verification is required only for products that make us publish something at your domain:
- Hosted Files on any plan
- The hosting add-on to the AI Visibility Kit
Free scans, Pro Reports, GEO Monitor and downloadable file generation need no verification — those read your site or hand you files, and publish nothing on your behalf.
It happens before payment, not after. Checkout for a hosted product stays blocked until verification succeeds, so you are never charged for a domain that turns out not to be yours to configure.
What it costs
Nothing. Verification is free, and it does not consume a scan, a credit, or anything else. Our WordPress plugin is free to install and use for verification whether or not you ever buy a subscription.
The four methods
All four prove the same thing and carry equal weight. Choose on the basis of what you have access to — most people should start at the top.
| Method | You need | Speed |
|---|---|---|
| WordPress plugin | WordPress admin | Seconds |
| Meta tag | Ability to edit your homepage <head> | Seconds |
| Upload a file | FTP, cPanel, or repository access | Seconds |
| DNS TXT record | Registrar or DNS provider login | 5–30 min, up to 48 h |
There is a fifth route you may never notice: if your domain is already pointed at serve.indexora.app, or you already have an active hosted domain with us, that counts on its own and verification passes silently.
You do not need your registrar. The first three methods never touch DNS. If you manage a client's website you almost certainly have one of them, and requesting registrar access from the client is not necessary.
One code for every method
Start at indexora.app/verify and enter your domain. You get a single verification code that works with all four methods, so if you start with a meta tag, find your theme has nowhere to put it, and install the plugin instead, the same code still applies — there is nothing to regenerate. When you press Check verification we look for the code everywhere, not only in the method you selected.
Method 1 — WordPress plugin
The fastest route for the majority of sites, and the only one that needs no copy-paste into a theme or DNS panel.
- Download the plugin (free, no subscription needed)
- In wp-admin: Plugins → Add New Plugin → Upload Plugin → choose the zip → Install Now → Activate
- Go to Settings → Indexora AI Files
- Paste your code into Step 1 · Verification Code and click Save & Verify
Saving checks with us immediately, so the page usually reads Domain verified before you switch back to indexora.app. Already running the plugin for Hosted Files? Just paste the code — no reinstall, and your Hosting Token is untouched.
The plugin requires version 1.3.0 or later. Older installs will show the update in Dashboard → Updates; see the plugin docs for the update path.
It also removes the setup step later. On v1.4.0 and above, verifying this way registers your site with us, so if you go on to buy Hosted Files your site collects its own Hosting Token and starts serving your files by itself — no token to copy, no second trip to wp-admin. That only happens if you verify with the plugin; the other three methods leave you to paste a token as before.
Method 2 — Meta tag
Add a single tag to the <head> of your homepage. It is invisible to visitors and has no effect on your SEO or your site's behaviour.
<meta name="indexora-site-verification" content="YOUR-CODE" />Most platforms already have a field built for exactly this, because Google Search Console established the pattern:
- Yoast SEO — SEO → General → Webmaster Tools
- Rank Math — General Settings → Webmaster Tools
- Squarespace — Settings → Developer Tools → Code Injection → Header
- Shopify — Online Store → Themes → Edit code →
theme.liquid - Webflow — Project Settings → Custom Code → Head Code
The tag must be in <head>, not in page content. If you have just added it and the check fails, clear your site or CDN cache first — you are almost certainly being served a cached copy of the old page.
Method 3 — Upload a file
Create a plain text file containing your code and nothing else, and upload it so it is reachable at:
https://yourdomain.com/.well-known/indexora-verification.txtBest for static sites, headless setups, and anyone with FTP or cPanel but no CMS. Open the URL in a browser before checking — it should show the code as plain text. If you see a styled 404 page, the file is not where we are looking for it.
Method 4 — DNS TXT record
The traditional route, and the slowest — not because the check is slow, but because you wait on DNS propagation while the other three are live the moment you save them. Use it when you have registrar access and none of the site-level options.
Type: TXT
Host: _indexora.yourdomain.com
Value: indexora-verify=YOUR-CODE
TTL: 3600 (or Auto)Changes typically appear within 5–30 minutes but can take up to 48 hours. If you do not manage DNS yourself, the verify page generates a ready-to-send note for whoever does.
How long verification lasts
A completed verification stands for 90 days, after which we may ask you to re-establish it. Domains change hands, and a one-time check cannot prove control forever.
In practice this is close to invisible: almost nobody removes the meta tag, file or plugin after verifying, so when the 90 days elapse your proof is still published and re-checking passes immediately without you touching your site. Your original code stays valid for exactly this reason — we do not issue a new one and make you republish something that is already there.
What we actually request from your site
Verification is deliberately narrow. Depending on the method, we make a DNS lookup, or one ordinary HTTP request to your homepage or to the specific file path shown to you, and read only enough to find the code we issued. We do not crawl the rest of your site, and we do not store its content as part of verification. Our requests identify themselves as Indexora-DomainVerification/1.0 if you need to allow-list them.
The web-based methods establish that you control the server answering for your hostname. That is the relevant question here, because what you are authorising is the publication of files served at that hostname. Verification is not an adjudication of trademark or registrant rights — see Terms of Service §4.1.
Troubleshooting
- "We couldn't reach the plugin on your site" — the site must be publicly reachable. Maintenance mode, a staging password, an IP allow-list, or Cloudflare "Under Attack" mode will all block us. Disable temporarily, verify, re-enable.
- Meta tag not found — view your homepage source and confirm the tag appears before
</head>. A tag added by a page builder into body content will not be accepted. Purge every cache layer, including your CDN. - File returns a 404 page — some hosts block dot-directories like
/.well-known/. If you cannot make that path serve, use the meta tag instead. - TXT record not found — check whether your provider wants
_indexoraalone rather than the full_indexora.yourdomain.com; many append the domain automatically and a doubled-up name will not resolve. - "This code is for another domain" — the code is bound to the exact hostname you entered. Proving control of
blog.example.comdoes not verifyexample.com; generate a code for the domain you actually want to host. - Still stuck — email [email protected] with your domain and the method you tried.