facebookexternalhit

Class: Link preview
robots.txt: May bypass robots.txt; May bypass robots.txt for security checks.
Evidence: Confirmed from operator documentation; Source

Published User-Agent

facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)

Proving it is real

Meta publishes no way to confirm this identity, so any request using this name has to be taken on trust.

robots.txt

User-agent: facebookexternalhit
Disallow: /

Cloudflare custom rule expression

(http.user_agent contains "facebookexternalhit")

nginx

if ($http_user_agent ~* "facebookexternalhit") {
    return 403;
}

Matching a name only blocks bots that tell the truth about it. Before you do this, read what each decision costs.

Last reviewed Nov 2, 2026