facebookexternalhit
facebookexternalhit is a bot operated by Meta/Facebook that crawls the web automatically. Note that excluding FacebookExternalHit will block incorporating OpenGraph data when sharing in social media, including rich links in Apple's Messages app. It does not honour robots.txt, and a request claiming to be facebookexternalhit can be checked against the operator's announced ASN.
facebookexternalhit at a glance
| User agent | facebookexternalhitToken only. The operator has not published a full user-agent string, so match on the substring rather than an exact header. |
|---|---|
| Operator | Meta/Facebook |
| Purpose | Ostensibly only for sharing, but likely used as an AI crawler as well |
| Respects robots.txt | Nosource |
| Verification method | Operator ASN check The link-preview scraper. It has existed far longer than the AI agents and is the most commonly spoofed Meta token, so check AS32934 before trusting it. https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/ |
| Crawl pattern | Not published |
| Robots.txt tokens | facebookexternalhit |
| Operator documentation | https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/ |
Note that excluding FacebookExternalHit will block incorporating OpenGraph data when sharing in social media, including rich links in Apple's Messages app. According to Meta, its purpose is "to crawl the content of an app or website that was shared on one of Meta’s family of apps…". However, see discussions here and here for evidence to the contrary.
Allow or block facebookexternalhit
Paste one of these into the robots.txt file at the root of your domain. Rules are per token, so a block on one crawler leaves every other bot untouched. facebookexternalhit is documented as ignoring robots.txt, so treat the block below as a statement of intent and enforce it at your CDN.
User-agent: facebookexternalhit
Disallow: /Blocks every path for this crawler only.
User-agent: facebookexternalhit
Allow: /Explicit allow. Useful when a wildcard rule above it would otherwise catch this crawler.
User-agent: facebookexternalhit
Allow: /
Disallow: /account/
Disallow: /checkout/
Disallow: /searchEdit the Disallow paths to match your own account, checkout and search URLs.
What blocking actually costs you
Blocking facebookexternalhit stops this specific token. Check your logs afterwards, because operators that ignore robots.txt often come back under a different name.
Block every crawler in the directory at onceIs that really facebookexternalhit?
A user-agent header is a string the client chooses. Scrapers copy facebookexternalhit precisely because site owners allow it. The link-preview scraper. It has existed far longer than the AI agents and is the most commonly spoofed Meta token, so check AS32934 before trusting it.
Paste the IP address from your access log below. You will see whether it belongs to a hosting provider, a residential proxy pool or a Tor exit, plus the ASN that announces it, which is what tells you whether the claim holds up.
Other crawlers run by Meta/Facebook
Related crawlers
Identify crawlers automatically instead of by hand
Agentscan checks a request against published crawler ranges, reverse DNS and hosting data, then returns a verdict your edge can act on. One call per request, no range files to keep up to date.