Link previews, run by Meta.

What is facebookexternalhit? Meta's link preview fetcher. It can't be verified beyond its name.

Run by Meta.
Purpose: Link previews. A visit means someone shared a link to your page in a chat or social app, and the app fetched it to draw the preview card.
robots.txt name: facebookexternalhit.
Name only: no published list to check a visit against.

At a glance, the facts in one table.

facebookexternalhit at a glance. Taken from SenseGap's open bot directory, the same data that sorts every visit in the dashboard.

facebookexternalhit facts
	facebookexternalhit
Operator	Meta
Purpose	Link previews
User agent contains	`facebookexternalhit`, `facebookcatalog`
robots.txt name	`facebookexternalhit`
Verification	Name only
Documentation	None listed

Purpose, what it does and why it came.

What facebookexternalhit does. SenseGap sorts every visit by purpose. facebookexternalhit is in the Link previews group.

facebookexternalhit is Meta's fetcher that loads a page's title, description and image when someone shares a link in Meta's apps.

What a visit means

A visit means someone shared a link to your page in a chat or social app, and the app fetched it to draw the preview card.

Detection, the header SenseGap matches.

How SenseGap recognizes facebookexternalhit. By its User-Agent header. A separate check then decides whether the visit is real.

Every request carries a User-Agent header naming the software that sent it. SenseGap counts a request as facebookexternalhit when that header contains any of facebookexternalhit or facebookcatalog, in any letter case. The header is plain text, so any script can copy it. Matching the name is where recognition starts, not where trust starts.

Pattern matched against User-Agent

/facebookexternalhit|facebookcatalog/i

Verification, how to tell a real visit from a fake.

facebookexternalhit can't be fully verified. SenseGap knows of no published IP ranges or DNS names for it, so the name is all there is.

How we verify bots

What this means

Not beyond the user agent. SenseGap knows of no published IP ranges or DNS names for facebookexternalhit, so anyone can send its name. SenseGap marks these visits Unverified rather than calling them real.

robots.txt, rules you can copy.

Block or allow facebookexternalhit in robots.txt. Its robots.txt name is facebookexternalhit. Paste a group into the robots.txt at your site's root.

Block the whole site

User-agent: facebookexternalhit
Disallow: /

Allow the whole site

User-agent: facebookexternalhit
Allow: /

Block one folder

User-agent: facebookexternalhit
Disallow: /private/

One rule catches people out. Under the robots.txt standard (RFC 9309), a crawler that finds a group naming it follows only that group and ignores your User-agent: * rules. If you add a facebookexternalhit group, repeat in it anything from the catch-all group you still want applied.

robots.txt is a request, not a lock. To enforce a block, match the User-Agent header at your server or CDN. In nginx:

Enforce it at the server

# nginx, inside a server block
if ($http_user_agent ~* "facebookexternalhit|facebookcatalog") {
    return 403;
}

SenseGap reads your robots.txt and shows, bot by bot, what you allow and which bots fetched pages you disallowed. See what you get.

Trade-off, what blocking changes.

Should you block facebookexternalhit? It depends on what you want from Meta. Here is what each choice means.

If you allow it
Links to your pages show a title, description and image when people share them.
If you block it
Shared links to your pages appear as bare URLs, without a preview card.

Meta, every bot it runs.

More bots from Meta. Meta runs 5 bots in the directory, each with its own job.

Link previews, other bots with the same job.

facebookexternalhit, answered plainly