EnterraHost
Ahrefs site verification is what pairs a project with a domain you actually control, and it costs nothing. Verified projects are free and unlimited on any plan, including the free one, so this is not a paid feature you are being nudged toward.
You are proving ownership rather than installing something. Ahrefs hands you a token, you put it on the domain, and it checks. It keeps checking, which is the part most guides leave out.
The four ways to complete Ahrefs site verification
Google Search Console, a DNS TXT record, an HTML file, and an HTML tag. That is the whole list. There is no Google Analytics method, which is a common mix-up, and nothing about Ahrefs Web Analytics is a verification method either.
Google Search Console
Ahrefs calls this one the recommended route, because it connects an account you already have. The project has to be added in the same mode as it appears in Search Console, so a www against a non-www will not connect.
DNS TXT record
Add the TXT record Ahrefs shows you at your DNS provider. The record name is often "@" or left blank, depending on the provider. Allow up to 48 hours before deciding it has failed, because DNS is not instant. This is the method to pick when you would rather not touch the website at all.
HTML file
Download the file Ahrefs gives you and upload it to the root folder of the domain, so it sits beside your index file rather than inside a subfolder.
HTML tag
The tag goes in the head of the homepage. Ahrefs checks there, and warns that a tag in the body does not count. That is worth knowing, because plenty of tools offer to insert code and will happily drop it into the body and report success.
<meta name="ahrefs-site-verification" content="...">Inside the project's ownership settings, Ahrefs shows the tag to copy. The value is long and opaque, and it belongs to the project you opened it in.
The tag has to stay, and that surprises people
Ahrefs re-checks ownership before each crawl and regularly in between, so removing the tag after a green tick can take verification away again. There is no published grace period. Leave it where it is, and treat it as part of the site rather than a temporary step.
If the settings say verified while the current crawl still says not verified, the verification simply happened after that crawl started. The next one catches up.
Adding the tag on Joomla without editing template files
This is where most of the frustration lives, because Joomla has no core field for head code. Global Configuration does not offer one, and the Custom HTML module is not the answer. A module renders into a module position, and module positions live in the body, which is the one place the tag cannot go.
That leaves four honest options.
If the site runs a template framework, check whether it already has a head field. Helix Ultimate has one under Template Options, on the Custom Code tab, labeled "Before </head>". It is designed for exactly this and it stores the value in the template settings, so no file is edited. Other frameworks have equivalents, and it is worth looking before installing anything.
If the template has no such field, a system plugin that injects head code does the job. HeadTag is one, listed in the Joomla Extensions Directory and declaring Joomla 5 compatibility. Check the compatibility badges before installing, because a plugin that never declared Joomla 4 or 5 support will not go on a modern site.
A child template override also works. It keeps the parent template untouched, which is the point of child templates, but it is file work and it is what most people are trying to avoid.
The fourth option is to skip Joomla entirely. DNS TXT records, the HTML file, and the Search Console connection all verify a domain without the website knowing anything about it. For a site owner who does not want to touch the CMS, that is not a workaround. It is the better route.
On WordPress
The same tag, the same head requirement, and a shorter list of options. Ahrefs' own walkthrough names the Meta Tag Manager plugin, which exists to add meta tags without editing theme files. An SEO plugin with a header code area will also do it.
If your theme offers a custom code section that injects into the head, that works too. What does not work is a widget or a block, for the same reason the Custom HTML module does not work on Joomla.
What actually goes wrong
Three things, over and over. Expecting it to be instant, when a DNS record can take up to 48 hours and a tag waits for the next crawl. Putting the tag in the body. And removing it once it works.
One more worth knowing. Ahrefs provides a "Check Status" action in the ownership settings rather than a command, so there is nothing to run from a terminal. Add the asset, use that button, and if it still is not verified, check that the Ahrefs crawler can reach the site at all before changing anything.
If you are already checking your site with our own tools, the sitemap validator catches the other half of the same problem, which is a sitemap that is fine for a browser and broken for a crawler.