Meta
facebookexternalhit
What it is
Link-preview fetch issued when a page is shared on a Meta surface. It needs its own entry because the broader Meta-ExternalAgent pattern does not match it.
In Aiola's taxonomy, Other means fetched for ads or link previews rather than answering, indexing, or training.
User agent
Look for the match token inside the complete HTTP User-Agent header. Tokens can be spoofed, so use the network checks below for authentication.
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)facebookexternalhitOfficial IP ranges
Meta's network is identified here as AS32934. ASN ownership is a useful signal, not a bot-specific allowlist; combine it with the User-Agent and request behavior.
Verify authenticity
Start with the source IP recorded by your trusted edge or server, not an untrusted forwarded header.
host REQUEST_IP
# Confirm the hostname ends in an official suffix
host RETURNED_HOSTNAME
# The forward lookup must return REQUEST_IPFor production checks, test against every current prefix in the vendor feed. Re-fetch feeds regularly: a July 2026 snapshot is evidence of publication, not a permanent firewall list.
Control it with robots.txt
Meta documents crawler controls for this bot family. Robots.txt can direct cooperative crawling, but it cannot prove that a request is authentic.
User-agent: facebookexternalhit
Allow: /User-agent: facebookexternalhit
Disallow: /Track it
Aiola tracks this crawler on your site — crawls, pages, trends. See when facebookexternalhit arrives, which URLs it requests, and how activity changes over time.
Explore Aiola AnalyticsFAQ
What is facebookexternalhit?
Link-preview fetch issued when a page is shared on a Meta surface. It needs its own entry because the broader Meta-ExternalAgent pattern does not match it.
What user-agent token identifies facebookexternalhit?
Match the case-insensitive token “facebookexternalhit” in the User-Agent header. A matching header alone does not authenticate the sender.
Can I verify facebookexternalhit by IP address?
Meta traffic can be checked against AS32934, but an ASN is broad. Combine network ownership with the exact user-agent token and your own risk controls.
Can robots.txt block facebookexternalhit?
Meta documents crawler controls for this bot family. Robots.txt can direct cooperative crawling, but it cannot prove that a request is authentic. Use the specific “facebookexternalhit” group when you want a rule for this identity without changing rules for every crawler.