diff --git a/index.php b/index.php
index b3d6f44..3a1e161 100644
--- a/index.php
+++ b/index.php
@@ -520,10 +520,10 @@ if ($page === 'activate') {
             <p class="text-muted small mb-4"><?= $lang === 'ar' ? 'يرجى إدخال مفتاح التسلسل للمتابعة.' : 'Please enter your serial key to continue using the application.' ?></p>
             
             <?php if ($error): ?>
-                <div class="alert alert-danger small"><?= $error ?></div>
+                <div class="alert alert-danger small"><?= htmlspecialchars((string)$error) ?></div>
             <?php endif; ?>
             <?php if ($success): ?>
-                <div class="alert alert-success small"><?= $success ?></div>
+                <div class="alert alert-success small"><?= htmlspecialchars((string)$success) ?></div>
             <?php endif; ?>
 
             <form method="POST">
diff --git a/lib/LicenseService.php b/lib/LicenseService.php
index 859f5ae..a6c2b73 100644
--- a/lib/LicenseService.php
+++ b/lib/LicenseService.php
@@ -8,19 +8,53 @@ class LicenseService {
     private static $settings_cache = null;
     private static $identity_cache = null;
 
+    private static function normalizeApiBaseUrl($url) {
+        $url = trim((string)$url);
+        if ($url === '') {
+            return '';
+        }
+
+        $url = preg_replace('#/(?:index|manage|install)\.php(?:\?.*)?$#i', '', $url);
+        return rtrim((string)$url, '/');
+    }
+
+    private static function detectLocalApiUrl() {
+        if (PHP_SAPI === 'cli') {
+            return '';
+        }
+
+        $host = trim((string)($_SERVER['HTTP_HOST'] ?? ''));
+        if ($host === '') {
+            return '';
+        }
+
+        $isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
+            || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower((string)$_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https');
+        $scheme = $isHttps ? 'https' : 'http';
+
+        $scriptName = str_replace('\\', '/', (string)($_SERVER['SCRIPT_NAME'] ?? '/index.php'));
+        $baseDir = rtrim(dirname($scriptName), '/');
+        if ($baseDir === '.' || $baseDir === '/') {
+            $baseDir = '';
+        }
+
+        return self::normalizeApiBaseUrl($scheme . '://' . $host . $baseDir . '/central_license_manager');
+    }
+
     private static function getApiUrl() {
         if (self::$remote_api_url !== null) {
             return self::$remote_api_url;
         }
 
-        $configured = trim((string)(getenv('LICENSE_API_URL') ?: ''));
+        $configured = self::normalizeApiBaseUrl(getenv('LICENSE_API_URL') ?: '');
         if ($configured !== '') {
-            self::$remote_api_url = rtrim($configured, '/');
+            self::$remote_api_url = $configured;
             return self::$remote_api_url;
         }
 
         if (file_exists(__DIR__ . '/../central_license_manager/index.php')) {
-            self::$remote_api_url = 'http://127.0.0.1/central_license_manager';
+            $detectedLocalUrl = self::detectLocalApiUrl();
+            self::$remote_api_url = $detectedLocalUrl !== '' ? $detectedLocalUrl : 'http://127.0.0.1/central_license_manager';
             return self::$remote_api_url;
         }
 
@@ -477,6 +511,7 @@ class LicenseService {
         curl_setopt($ch, CURLOPT_TIMEOUT, 10);
         $resp = curl_exec($ch);
         $http_code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        $content_type = (string)curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
         $curl_error = curl_error($ch);
         curl_close($ch);
 
@@ -486,7 +521,24 @@ class LicenseService {
 
         $data = json_decode($resp, true);
         if (!is_array($data)) {
-            return ['success' => false, 'error' => 'Invalid response from remote server.'];
+            $preview = trim((string)preg_replace('/\s+/', ' ', strip_tags((string)$resp)));
+            if ($preview !== '' && strlen($preview) > 180) {
+                $preview = substr($preview, 0, 177) . '...';
+            }
+
+            $error = 'Invalid response from remote server.';
+            if ($http_code > 0) {
+                $error .= ' HTTP ' . $http_code . '.';
+            }
+            if ($content_type !== '') {
+                $error .= ' Content-Type: ' . $content_type . '.';
+            }
+            $error .= ' URL: ' . $url . '.';
+            if ($preview !== '') {
+                $error .= ' Preview: ' . $preview;
+            }
+
+            return ['success' => false, 'error' => $error];
         }
 
         if ($http_code < 200 || $http_code >= 300) {