Post #1708516

good to know it's narrowed down to the security software. if it's ModSecurity or Cloudflare WAF, the common fix is adding an exception for the /.well-known/webfinger and /.well-known/nodeinfo paths — security rules often block those endpoints by default. the ActivityPub plugin needs those to route correctly. happy to take a look if you want