What is facebookexternalhit? Meta's link preview crawler
facebookexternalhit is the crawler Meta says fetches a page when someone shares its link on Facebook, Instagram or Messenger, to show the title, summary and preview image.
18 of the 1664 major websites we measure block facebookexternalhit in robots.txt (1%). 97 of those sites name it directly in their robots.txt; the rest are covered by a wildcard rule.
Key facts
| Fact | Detail |
|---|---|
| Operator | Meta |
| Used for | Link previews on Facebook, Instagram and Messenger |
| Type | Link preview. Fetches a page to show a preview when someone shares its link. It isn't counted in the AI crawler figures. |
| robots.txt token | facebookexternalhit |
| Operator's documentation | Read it here |
What blocking facebookexternalhit does
Blocking it removes the preview from shared links. Meta says the crawler can bypass robots.txt when it runs security or integrity checks, such as scanning for malware.
How to allow or block facebookexternalhit
Add one of these groups to the robots.txt file at the root of your domain. It is a stated preference that well-behaved crawlers read, not an enforcement mechanism.
User-agent: facebookexternalhit Disallow: /
User-agent: facebookexternalhit Allow: /
facebookexternalhit user agent string
The string Meta documents. Version numbers can change, so match on the name.
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
How to verify a request is really facebookexternalhit
Anyone can put a crawler's name in a user agent string, so the name alone proves nothing. We did not find a published IP list or reverse DNS rule from Meta.
How to whitelist facebookexternalhit in a firewall or CDN
robots.txt only states a preference. A firewall, CDN or bot protection service can still refuse the request, and the crawler then gets an error even though robots.txt allows it.
- Check that no group in your robots.txt blocks it, using the rule above.
- Add an allow rule in your firewall or CDN that matches the name in the user agent. Keep the rule narrow, because anyone can copy a name.
- Check your server logs for a 200 response from facebookexternalhit afterwards.
On Cloudflare, also check AI Crawler and Agent access policies, which can block search, agent and training traffic across a site.
Why facebookexternalhit gets a 403 or 405 error
A 403 means the server refused the request, which usually points to a firewall or bot rule. A 405 means the server refused the request's method, so check any rule that only permits certain methods. A crawler that obeys robots.txt won't request a page it is told to avoid, so an error in your logs points to your server's configuration. To stop it deliberately at the server, this nginx rule returns a 403:
if ($http_user_agent ~* "facebookexternalhit") {
return 403;
}Who blocks facebookexternalhit, by sector
| Sector | Sites measured | Blocking | Share |
|---|---|---|---|
| Reference and research | 114 | 4 | 4% |
| News publishers | 182 | 6 | 3% |
| AI companies | 128 | 2 | 2% |
| Social and media platforms | 115 | 2 | 2% |
| Developer references | 160 | 1 | 1% |
| Finance and business media | 94 | 1 | 1% |
| Government and institutions | 98 | 1 | 1% |
| SaaS platforms | 196 | 1 | 1% |
| E-commerce and retail | 92 | 0 | 0% |
| Health publishers | 89 | 0 | 0% |
| Hosting and infrastructure | 98 | 0 | 0% |
| SEO and marketing tools | 86 | 0 | 0% |
| Technology media | 126 | 0 | 0% |
| Travel | 86 | 0 | 0% |
Sites blocking facebookexternalhit
afterpay.com, codeberg.org, congress.gov, distill.pub, faz.net, linguee.com, lobste.rs, magento.com, poe.com, politico.com, reddit.com, sciencedirect.com, todayonline.com, torontosun.com, vancouversun.com, wikihow.com, wordreference.com, yomiuri.co.jp.
Sites that allow facebookexternalhit by name
academia.edu, ai.meta.com, architecturaldigest.com, barrons.com, bensbites.com, bonappetit.com, canva.com, cntraveler.com, coinbase.com, consilium.europa.eu, deezer.com, dentalhealth.org, devclass.com, digitaltrends.com, disneyplus.com, dpreview.com, dropbox.com, dw.com, eff.org, elevenlabs.io, eluniversal.com.mx, epicurious.com, facebook.com, fastcompany.com, flickr.com, fortinet.com, gamma.app, gofundme.com, goodreads.com, gq.com, hackernoon.com, hilton.com, hindustantimes.com, ideogram.ai, imdb.com, inc.com, inc42.com, inquirer.net, instacart.com, instagram.com, and 49 more in the full dataset.
Other Meta crawlers
Meta-ExternalAgent (model training), Meta-ExternalFetcher (on-demand fetch), Meta-WebIndexer (Meta AI search index), Meta-ExternalAds (advertising products).
See all 36 AI crawlers, the rule change log or the full study. Being reachable is only the first step: how AI search engines choose what to cite covers the rest.
Cite this data
You are welcome to quote or republish these figures. Please credit IndexHalo with a link to this page (CC BY 4.0). All our datasets are on the data page.
IndexHalo. "facebookexternalhit block rate across major websites." Measured 12 November 2026. https://www.indexhalo.com/ai-crawlers/facebookexternalhit/
<a href="https://www.indexhalo.com/ai-crawlers/facebookexternalhit/">facebookexternalhit block rate across major websites, IndexHalo</a>