2017-12-15 UTC
# 
Zegnat GWG, in the response you can set any profile URL as long as it is on the same domain. So even if a user (accidentally) entered the root domain of their WP install, you can correct it. See https://indieauth.net/spec/#authorization-code-verification-p-2