Safe Official docs Social Media Bots

facebookexternalhit

Operated by Meta

Quick Facts

User-Agent:
facebookexternalhit
Category:
Social Media Bots
Operator:
Meta
Safety:
Safe
Blocking Impact:
Varies - Evaluate before blocking
SEO Impact Score:
0/10
Official docs:
developers.facebook.com

Confirmed by the operator

Meta names facebookexternalhit on its own documentation page, linked above. The token, purpose and robots.txt behaviour on this profile come from that page, re-checked on October 19, 2026.

What is facebookexternalhit?

This is the primary crawler for Facebook. It fetches content to generate previews (title, description, image) when a link is shared on Facebook.

This is the primary crawler for Facebook. It fetches content to generate previews (title, description, image) when a link is shared on Facebook.
facebookexternalhit is operated by Meta to generate rich link previews when URLs are shared on their platform. It sends GET requests to your URL, reads <meta property="og:..."> and <meta name="twitter:..."> tags, and caches the result. Blocking facebookexternalhit means all links to your domain shared on Meta appear as raw text without thumbnail, title, or description. This can reduce CTR from social referrals but has zero SEO impact.

What happens if you block facebookexternalhit?

❓ Impact Unknown - The SEO consequences of blocking facebookexternalhit are not fully documented. Before blocking, check your analytics to confirm whether this bot generates referral traffic, review your server logs for crawl frequency, and test in a staging environment if possible.
Generally safe to allow; provides legitimate crawling value.

How to block facebookexternalhit with robots.txt

<code>User-agent: facebookexternalhit</code> - Matching is case-insensitive. Robots.txt is fetched from the root of each subdomain separately.

Block completely (robots.txt)
User-agent: facebookexternalhit Disallow: /
Allow all (robots.txt)
User-agent: facebookexternalhit Allow: /
Block private only (robots.txt)
User-agent: facebookexternalhit Disallow: /private/ Disallow: /api/ Disallow: /admin/ Allow: /
Nginx server block
# Nginx: Hard-block facebookexternalhit if ($http_user_agent ~* "facebookexternalhit") { return 403 "Bot blocked"; }
Apache .htaccess
# Apache: Hard-block facebookexternalhit SetEnvIfNoCase User-Agent "facebookexternalhit" bad_bot Order Allow,Deny Allow from all Deny from env=bad_bot
Meta robots tag
<meta name="robots" content="noindex, nofollow">
X-Robots-Tag header
X-Robots-Tag: noindex, nofollow

Is facebookexternalhit safe to allow?

Yes, facebookexternalhit is a safe and legitimate crawler. It is operated by Meta, which publicly documents its crawler at an official URL and follows the Robots Exclusion Protocol (RFC 9309). The user-agent string facebookexternalhit is verifiable via reverse-DNS lookup on the crawling IP addresses. You can safely allow it unless you have a specific reason to block (e.g., AI training opt-out or SEO tool visibility).
Verify by reverse-DNS lookup: legitimate facebookexternalhit requests resolve to meta's domain.

What does facebookexternalhit do?

Understanding facebookexternalhit's purpose helps you decide whether to allow or block it.

  • Generates link previews for social media shares
  • Fetches Open Graph and Twitter Card metadata
  • Creates rich snippets when links are posted
  • Validates and displays website thumbnails
  • Improves user experience on social platforms

facebookexternalhit in context

facebookexternalhit is a utility crawler operated by Meta. In plain terms, it fetches a page to build a link preview when someone shares it. Our database files it under social preview bots and ranks it Tier 5, low-priority crawlers with limited upside for most sites. 8 of the 9 social preview bots in our database share this tier.

Its safety rating is safe and its blocking impact is not documented. So the decision about facebookexternalhit rests on what you want from Meta, not on its behaviour. How we rate safety and impact.

How site owners treat facebookexternalhit

Our robots.txt study of the Tranco top 10,000 did not track facebookexternalhit as a named token, so we do not publish an adoption figure for it. If you run a large site, your own logs are the best evidence of how often it visits.

Does it follow robots.txt?

facebookexternalhit's operator says it follows robots.txt, so a correctly written facebookexternalhit group is enough to control it.

Meta crawlers and close alternatives

facebookexternalhit is one of 8 Meta crawlers in our database. A User-agent: facebookexternalhit group controls facebookexternalhit only; the other Meta tokens below need their own lines.

  • facebookexternalhit: this crawler (Tier 5)
  • FacebookBot: Facebook Crawler, fetches a page to build a link preview when someone shares it (Tier 5)
  • Meta-ExternalAds: Meta Ads Crawler, checks pages for an SEO, uptime or analytics service (Tier 4)
  • Meta-ExternalAgent: Meta AI Training, collects pages to train AI models (Tier 1)
  • Meta-ExternalFetcher: Meta AI Fetcher, fetches a page when a person asks an assistant or app to open it (Tier 2)
  • meta-externaltest: Meta-ExternalTest, checks pages for an SEO, uptime or analytics service (Tier 4)
  • meta-webindexer: Meta Web Indexer, builds a search or answer index (Tier 2)
  • muse-: Meta Muse (personal agent), fetches a page when a person asks an assistant or app to open it (Tier 1)

To give facebookexternalhit the same answer as its siblings, stack User-agent: facebookexternalhit with their lines above one set of rules; to treat facebookexternalhit differently, give it its own group.

Other social preview bots that do the same job (fetches a page to build a link preview when someone shares it) include LinkedInBot from LinkedIn, Pinterestbot from Pinterest, Quora-Bot from Quora, Slackbot from Slack, Slackbot-LinkExpanding from Slack, Twitterbot from X (Twitter). Deciding about facebookexternalhit is usually a decision about the whole group, so check how your file treats these too.

We first recorded facebookexternalhit on March 17, 2026. Meta documents it on developers.facebook.com, and we recheck that page before each release.

Which rule facebookexternalhit actually follows

facebookexternalhit reads exactly one group in robots.txt, the most specific one that names facebookexternalhit, and never combines rules across groups. This short file shows the trap:

User-agent: *
Disallow: /private/

User-agent: facebookexternalhit
Disallow: /drafts/
  1. Find the group. facebookexternalhit looks for a group naming facebookexternalhit. One exists, so it ignores User-agent: * completely.
  2. Apply only that group. It is refused /drafts/ and nothing else.
  3. The surprise. /private/ is open to facebookexternalhit, because that rule lives in the * group it no longer reads. To keep it out of both, repeat Disallow: /private/ inside its own group.
Test yourself: does a rule under User-agent: * apply to facebookexternalhit if the file also has a User-agent: facebookexternalhit group?

No. Once a group names it, facebookexternalhit reads only that group. Put every rule you want it to follow inside its own group.

Test yourself: will blocking facebookexternalhit remove your pages from AI answers?

Often, yes. facebookexternalhit is a utility crawler, so pages it cannot fetch can drop out of the answers or results it supports.

Test yourself: is User-agent: facebookexternalhit the same as User-agent: facebookexternalhit?

Yes. RFC 9309 makes user-agent matching case-insensitive. Paths are a different story: Disallow: /Blog/ does not block /blog/.

Related: how AI engines choose their sources

Should you allow facebookexternalhit? Decide by situation

Recommended setting for facebookexternalhit by type of site
If you are...Recommended setting
You publish content and want AI answers to cite itLow stakes either way. It does not decide whether AI answers cite you.
You license content and want to stop AI trainingBlocking it does not stop training, because facebookexternalhit is a utility crawler. Block the operator's training crawler instead.
You run an online shopAllow it unless your logs show it is costly.
Your server is under load from botsRate-limit before blocking. It is rated safe in our database.

Check facebookexternalhit on your own site

  1. Open /robots.txt on your domain and search for facebookexternalhit. If it is not named, it follows User-agent: *.
  2. List the Disallow lines in the group facebookexternalhit follows and test your key URLs against them; the longest match wins, and Allow wins a tie.
  3. Look beyond the file. A firewall or bot manager can refuse facebookexternalhit even when robots.txt allows it, and that never shows in the file.
  4. Run our AI crawler tester to see how facebookexternalhit and every other crawler we track are treated in one pass, including firewall refusals.

Common mistakes with facebookexternalhit

The errors we see most often with facebookexternalhit in the files and firewalls we test:

  1. Treating facebookexternalhit as an AI or search crawler. Blocking it has little effect on visibility; decide based on load and what it does with your data.
  2. Relying on robots.txt alone when facebookexternalhit is rated caution or aggressive. Back the rule with a server-side block.
  3. Blocking facebookexternalhit by IP alone. Ranges change; match the token and verify with logs.

All three hide inside a file that looks correct, so check facebookexternalhit from outside after every change.

Spotting facebookexternalhit in your logs

robots.txt says what facebookexternalhit may do; your access logs show what it actually did.

Count requests

On a server with standard Nginx or Apache logs, this counts matching requests per day (adjust the log path for your host):

grep -iE "facebookexternalhit" /var/log/nginx/access.log \
  | awk '{print $4}' | cut -d: -f1 | sort | uniq -c

And this shows which paths it requested most, which is the quickest way to see whether your Disallow lines are being respected:

grep -iE "facebookexternalhit" /var/log/nginx/access.log \
  | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

Check the requests are genuine

Anyone can send the facebookexternalhit user-agent, so confirm the source before acting on a match:

  • facebookexternalhit: we hold no published IP list, so use reverse DNS where the operator documents a hostname and treat an unverifiable facebookexternalhit request with caution.

Frequently Asked Questions

What is the official user-agent string for facebookexternalhit?
The official user-agent string for facebookexternalhit is: facebookexternalhit. This is the exact string you must use in robots.txt, Nginx, Apache, or Cloudflare firewall rules to target this bot. User-agent matching in robots.txt is case-insensitive, but the string must be spelled correctly. You can verify that a request genuinely comes from facebookexternalhit by performing a reverse-DNS lookup on the source IP - legitimate bots resolve back to their operator's domain.
Is facebookexternalhit safe?
Yes, facebookexternalhit is a safe and legitimate crawler. It is operated by Meta, which publicly documents its crawler at an official URL and follows the Robots Exclusion Protocol (RFC 9309). The user-agent string facebookexternalhit is verifiable via reverse-DNS lookup on the crawling IP addresses. You can safely allow it unless you have a specific reason to block (e.g., AI training opt-out or SEO tool visibility).
Will blocking facebookexternalhit hurt my SEO?
❓ Impact Unknown - The SEO consequences of blocking facebookexternalhit are not fully documented. Before blocking, check your analytics to confirm whether this bot generates referral traffic, review your server logs for crawl frequency, and test in a staging environment if possible.
How do I block facebookexternalhit in robots.txt?
Add the following lines to your /robots.txt file:
User-agent: facebookexternalhit
Disallow: /

This instructs facebookexternalhit not to crawl any path on your site. The Disallow: / directive covers the entire domain including subfolders. To only block specific sections, replace / with the path (e.g., Disallow: /blog/). Note: robots.txt is publicly readable - any bot or human can inspect it at yourdomain.com/robots.txt.
Does facebookexternalhit respect robots.txt?
Yes - facebookexternalhit is a well-behaved bot operated by Meta. It fetches and parses /robots.txt before crawling any page, following RFC 9309.
How do I verify if facebookexternalhit is crawling my site?
Search your web server access logs for the string facebookexternalhit (case-insensitive grep: grep -i "facebookexternalhit" /var/log/nginx/access.log). You can also check Google Search Console → Coverage → Crawl Stats for Googlebot variants. For facebookexternalhit specifically, filter by user-agent in your log analysis tool (GoAccess, AWStats, etc.).
What is the crawl frequency of facebookexternalhit?
facebookexternalhit crawls at a moderate rate. If you notice excessive traffic in your logs, you can add a Crawl-delay directive: 
User-agent: facebookexternalhit
Crawl-delay: 10
(10 second delay between requests).
Can I block facebookexternalhit from specific pages only?
Yes. Instead of a global Disallow: / you can restrict facebookexternalhit to specific paths:
User-agent: facebookexternalhit
Disallow: /private/
Disallow: /staging/
Allow: /

This allows facebookexternalhit everywhere except the listed paths. Path matching in robots.txt uses prefix matching - Disallow: /private/ blocks /private/page.html but NOT /public/private/.
Why is my link preview broken when shared on Meta's platform?
If links to your site appear without a preview image or title on Meta, it's likely because:
1. facebookexternalhit (facebookexternalhit) is blocked in your robots.txt.
2. Your Open Graph meta tags are missing or malformed.
3. Meta's cache is stale - request a refresh using Meta's debugger tool.
Fix: Remove any block rule for facebookexternalhit and ensure your pages include <meta property="og:title">, og:description, and og:image.

Related Bots

WhatsApp us