// Meta
facebookexternalhit
// Overview
What it is
Link-preview fetch issued when a page is shared on a Meta surface. It needs its own entry because the broader Meta-ExternalAgent pattern does not match it.
In Aiola's taxonomy, Other means fetched for ads or link previews rather than answering, indexing, or training.
// Headers
User agent
Look for the match token inside the complete HTTP User-Agent header. Tokens can be spoofed, so use the network checks below for authentication.
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)facebookexternalhit// Network
Official IP ranges
Meta's network is identified here as AS32934. ASN ownership is a useful signal, not a bot-specific allowlist; combine it with the User-Agent and request behavior.
// Verification
Verify authenticity
Start with the source IP recorded by your trusted edge or server, not an untrusted forwarded header.
host REQUEST_IP
# Confirm the hostname ends in an official suffix
host RETURNED_HOSTNAME
# The forward lookup must return REQUEST_IPFor production checks, test against every current prefix in the vendor feed. Re-fetch feeds regularly: a July 2026 snapshot is evidence of publication, not a permanent firewall list.
// Robots.txt
Control it with robots.txt
Meta documents crawler controls for this bot family. Robots.txt can direct cooperative crawling, but it cannot prove that a request is authentic.
User-agent: facebookexternalhit
Allow: /User-agent: facebookexternalhit
Disallow: /// Analytics
Track it
Aiola tracks this crawler on your site — crawls, pages, trends. See when facebookexternalhit arrives, which URLs it requests, and how activity changes over time.
// FAQ
FAQ
What is facebookexternalhit?
Link-preview fetch issued when a page is shared on a Meta surface. It needs its own entry because the broader Meta-ExternalAgent pattern does not match it.
What user-agent token identifies facebookexternalhit?
Match the case-insensitive token “facebookexternalhit” in the User-Agent header. A matching header alone does not authenticate the sender.
Can I verify facebookexternalhit by IP address?
Meta traffic can be checked against AS32934, but an ASN is broad. Combine network ownership with the exact user-agent token and your own risk controls.
Can robots.txt block facebookexternalhit?
Meta documents crawler controls for this bot family. Robots.txt can direct cooperative crawling, but it cannot prove that a request is authentic. Use the specific “facebookexternalhit” group when you want a rule for this identity without changing rules for every crawler.
// Related