facebookexternalhit: Meta's Link Preview Crawler Explained

01 · Operator

Who operates facebookexternalhit

Company: Meta
Type: Social preview bot
Official docs: developers.facebook.com

02 · Behavior

What facebookexternalhit does

When someone shares a link in a Meta app, it fetches the page to read the title, description and image. The preview then shows in the post or message. Meta says it may bypass robots.txt for security or integrity checks, such as malware scans.

03 · Impact

Why facebookexternalhit matters for your site

If you allow it

Shared links show a proper preview with title and image
Previews make shared links more likely to be clicked

If you block it

It may bypass robots.txt for security checks
Blocking stops previews of your pages on Meta apps

04 · Allow

How to allow facebookexternalhit

robots.txt

User-agent: facebookexternalhit
Allow: /

Cloudflare

# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "facebookexternalhit")
Action:     Skip › All Super Bot Fight Mode rules

# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.

WordPress

# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: facebookexternalhit
Allow: /

nginx

# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "facebookexternalhit") { return 403; }

Apache

# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} facebookexternalhit [NC]
# RewriteRule .* - [F,L]

05 · Block

How to block facebookexternalhit

facebookexternalhit does not always follow robots.txt. Add a server or CDN rule if you need a hard block.

robots.txt

User-agent: facebookexternalhit
Disallow: /

Cloudflare

# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "facebookexternalhit")
Action:     Block

WordPress

# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: facebookexternalhit
Disallow: /

nginx

# In your server { } block:
if ($http_user_agent ~* "facebookexternalhit") {
    return 403;
}

Apache

# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} facebookexternalhit [NC]
RewriteRule .* - [F,L]
</IfModule>

06 · User agents

User agents we see for facebookexternalhit

The user agent published by the operator:

facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)

Other Meta bots

07 · Verification

Is it really facebookexternalhit?

facebookexternalhit’s operator publishes no IP ranges or hostnames, so requests cannot be verified. Treat the user agent as a claim, and watch your logs for unusual request rates.

FAQ

Questions about facebookexternalhit

What happens if I block facebookexternalhit?

Links to your site shared on Facebook, Instagram or Messenger will lack a proper preview. Meta may still fetch pages for security checks.

How do I verify facebookexternalhit IP addresses?

Meta suggests querying its AS32934 routes: whois -h whois.radb.net -- '-i origin AS32934' | grep ^route.

Is facebookexternalhit used to train AI models?

No. Meta lists Meta-ExternalAgent as its crawler for AI model training. facebookexternalhit fetches shared links for previews.

facebookexternalhit is Meta’s social preview bot