diff --git a/backend/tests/test_frontend_configuration.py b/backend/tests/test_frontend_configuration.py
new file mode 100644
index 0000000..19ae302
--- /dev/null
+++ b/backend/tests/test_frontend_configuration.py
@@ -0,0 +1,19 @@
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+CANONICAL_WORDPRESS_APP_URL = "https://calorietoken.net/index.php/calorieapp/"
+NON_CANONICAL_WORDPRESS_APP_URL = "https://calorietoken.net/calorieapp/"
+
+
+def test_frontend_uses_canonical_wordpress_calorieapp_route():
+    panel_source = (
+        REPO_ROOT / "frontend" / "components" / "XamanLoginPanel.tsx"
+    ).read_text(encoding="utf-8")
+    env_example = (REPO_ROOT / "frontend" / ".env.example").read_text(
+        encoding="utf-8"
+    )
+
+    for source in (panel_source, env_example):
+        assert CANONICAL_WORDPRESS_APP_URL in source
+        assert NON_CANONICAL_WORDPRESS_APP_URL not in source
diff --git a/frontend/.env.example b/frontend/.env.example
index 9f61495..19ac54b 100644
--- a/frontend/.env.example
+++ b/frontend/.env.example
@@ -11,7 +11,7 @@ NEXT_PUBLIC_BACKEND_WAKE_URL=http://localhost:8000
 
 # Same-browser WordPress launcher used only when the app is opened outside the
 # [calorieapp_embed] page. Keep this on the canonical CalorieToken site.
-NEXT_PUBLIC_WORDPRESS_APP_URL=https://calorietoken.net/calorieapp/
+NEXT_PUBLIC_WORDPRESS_APP_URL=https://calorietoken.net/index.php/calorieapp/
 
 # Optional: frontend-only post-login fallback route if you need custom UX.
 # Keep this app-local (starts with /) and do not put secrets here.
diff --git a/frontend/components/XamanLoginPanel.tsx b/frontend/components/XamanLoginPanel.tsx
index 0289a25..749ae4e 100644
--- a/frontend/components/XamanLoginPanel.tsx
+++ b/frontend/components/XamanLoginPanel.tsx
@@ -47,7 +47,7 @@ const PENDING_LOGIN_STORAGE_KEY = "calorieapp-pending-xaman-login";
 const LOGIN_RETURN_STORAGE_KEY = "calorieapp-login-return";
 const WORDPRESS_APP_URL =
   process.env.NEXT_PUBLIC_WORDPRESS_APP_URL?.trim() ||
-  "https://calorietoken.net/calorieapp/";
+  "https://calorietoken.net/index.php/calorieapp/";
 
 type ParentBridgeMessage = {
   type?: unknown;