What a verified Mastodon link actually proves
A verified link on a Mastodon profile is a cross-reference between two web properties. The platform checks that a page you control links back to your Mastodon profile using a specific HTML attribute. That is a technical handshake about control of a domain and a profile, not a background check on a person.
Mastodon can verify an HTTPS profile metadata link by checking for a matching link back to the Mastodon profile using rel=me. Source
Mastodon describes verified links as a cross-reference confirming ownership of a linked webpage. Source
The practical consequence: a green check or highlighted link tells you the person who controls the Mastodon account also controls the linked website, or at least can edit its HTML. It does not tell you the person’s legal name, employer, professional licence, criminal record, or good character. It also does not prove that two public accounts on different platforms belong to the same human being.
This guide is about evaluating that specific claim — “this Mastodon profile is connected to this website” — without sliding into a broader background check the evidence cannot support.
Step 1: Identify the exact claim being made
Before checking anything, write down what the profile actually asserts. A Mastodon profile can list several metadata links. Only some may be verified. The claim is usually one of these:
- “This Mastodon account belongs to the person or organisation behind example.com.”
- “This website is the official home of this Mastodon account.”
- “These two accounts are the same entity.”
The first two are claims about control of a domain and a profile. The third is a claim about identity across platforms, which a reciprocal link alone cannot establish.
Decision table for reading the claim:
| What you see | What it supports | What it does not support |
|---|---|---|
| A verified link to a personal site | The Mastodon account holder can edit that site’s HTML | The person’s legal identity or credentials |
| A verified link to an employer’s domain | A connection between the account and someone with publishing access to that domain | That the account holder is an employee in good standing |
| A verified link to a portfolio or shop | Control of that web property | Ownership of the work shown, or professional licensing |
| Two accounts linking to the same site | Both can edit that site, or both were given access | That the two accounts are run by the same person |
| No verified link | Nothing about domain control | That the account is fake or unofficial |
Step 2: Check the direction of the link
A Mastodon verification is reciprocal. The profile lists a URL, and the page at that URL must contain a link back to the Mastodon profile with the rel=“me” attribute. If you only see the link on the Mastodon profile, you have half the evidence.
Open the linked page in a browser and view its HTML source. Search for the Mastodon profile URL. You are looking for an anchor element that points to the profile and carries rel=“me”. A plain link without that attribute is a link, not a verification signal.
The verification link must be present in the HTML response and accessible without running JavaScript. Source
This JavaScript requirement matters for investigators. If the rel=“me” link is injected by a script after page load, a source-code check may miss it, and a simple HTML fetch will not see it. The verification depends on what the server returns in the HTML response, not on what a browser renders later.
Step 3: Confirm you are looking at the right domain
Domain control is the core of the claim, so check the domain carefully.
- Look at the exact hostname, not just the visible brand name. Subdomains and lookalike domains are different properties.
- Check whether the page is served over HTTPS, since the verification link must be an HTTPS profile metadata link.
- Confirm the page is the canonical page for that URL, not a temporary landing page or a parked domain.
- If the link points to a platform-hosted page (a shop, a portfolio host, a newsletter), remember that control of that page may be shared with the platform or with other administrators.
A verified link to a large platform page is weaker evidence of individual control than a verified link to a personal domain the person registered. Neither proves identity.
Step 4: Separate domain control from identity
This is where most investigations go wrong. A reciprocal link is evidence of technical control. Identity is a separate question that usually requires corroborating sources: consistent biographical details across independent sites, public records where lawful, direct contact through a channel you already trust, or organisational confirmation.
A useful rule: treat a verified Mastodon link as one lead among several. It can raise or lower your confidence that an account is officially connected to a website. It should not be the sole basis for concluding who someone is.
If you are assessing whether an account is impersonating someone, the reciprocal link is only one signal. A fake account can link to a real website without controlling it, and a real person can fail to set up verification. The absence of a verified link is not evidence of fraud.
For a broader framework on evaluating suspicious accounts, see the guide on who is behind a fake account. For how we handle evidence and uncertainty, see our methodology.
Step 5: Record what you checked and what you did not
Write a short evidence note. Investigators and readers both benefit from knowing the boundaries of a check.
| Check | Result | Confidence note |
|---|---|---|
| Profile lists the URL | Yes / No | Note the exact URL shown |
| Page HTML contains rel=“me” link to profile | Yes / No / Not visible without JavaScript | Record how you checked |
| Domain matches the claimed organisation | Yes / No / Partial | Note registrable domain vs subdomain |
| Independent corroboration of identity | Yes / No | List sources, not assumptions |
| Claim being made | Domain control / Identity / Both | Keep the claim narrow |
This note protects you from overstating the result later. It also makes clear that a missing or failed check is not proof of anything beyond the check itself.
Common mistakes
Treating verification as a background check. A verified link confirms a cross-reference between a profile and a webpage. It says nothing about legal identity, professional licensing, employment status, or character.
Checking only the Mastodon profile. The reciprocal link on the website is the part that carries the verification signal. Without it, you have a claim, not a confirmation.
Ignoring JavaScript. A link that appears only after scripts run is not the same as a link present in the HTML response. Verify the way the platform does.
Assuming two accounts are the same person. Two profiles linking to the same website may both have publishing access, or one may link to a site they do not control. A shared link is not a shared identity.
Treating an unverified profile as fake. Many legitimate accounts never set up verification. Absence of a verified link is not evidence of impersonation.
Overlooking subdomains and redirects. A link to a subdomain or a redirected URL may not represent the domain you think it does. Check the final destination and the exact hostname.
Confusing a platform-hosted page with a personal domain. Control of a page on a shared platform is weaker evidence of individual control than a domain the person registered.
Protecting your own footprint
If you run a Mastodon profile and link to your own site, the verification setup is a small piece of a larger hygiene question. Keep the following in mind.
- Publish the rel=“me” link in the server-rendered HTML of your page, not only through client-side scripts, so the cross-reference is visible to the platform’s check.
- Keep your profile metadata links current. A stale link to a domain you no longer control can misrepresent your connection.
- Remember that a verified link is public and quotable. It tells readers that you control the linked page, which is usually what you want, but it also creates a public association between the two properties.
- Do not treat verification as a substitute for clear biographical information. Readers still need context to understand who you are.
- If you are cleaning up old accounts, keep a recovery method you control until closure is complete, and remember that removing a link or editing a profile does not by itself delete stored data.
A username search can help you review which public handles are associated with a name you use. TraceSeek checks 3,000+ platforms and returns public matches in 20-30 seconds, with a free first scan. Those matches are leads for your own review, not proof of ownership, and the app does not change Mastodon settings or verify links for you.
Key facts
Mastodon can verify an HTTPS profile metadata link by checking for a matching link back to the Mastodon profile using rel=me.
The verification link must be present in the HTML response and accessible without running JavaScript.
Mastodon describes verified links as a cross-reference confirming ownership of a linked webpage.
A verified link confirms control of a webpage, not a person’s legal identity, professional licensing, or good character.