FacebookExternalHit is a bot in the link preview bots category, operated by Meta.
The primary purpose of FacebookExternalHit is to crawl the content of an app or website that was shared on one of Meta’s family of apps, such as Facebook, Instagram, or Messenger. The link might have been shared by copying and pasting or by using the Facebook social plugin. This crawler gathers, caches, and displays information about the app or website such as its title, description, and thumbnail image.
Link preview bots fetch a page when someone shares its URL in a chat app or social network, to build the preview card. Blocking them breaks your link previews, so keep them allowed but leave them out of analytics and ad requests.
Sample user agent strings sent by FacebookExternalHit:
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)facebookexternalhit\/1.1 (+http:\/\/www.facebook.com\/externalhit_uatext.php)facebookexternalhit/1.1facebookcatalog/1.0Anyone can copy a user agent string. Transfon Security also checks where each request comes from, so a request that claims to be a known crawler but comes from the wrong network is treated as a fake, not as the real crawler.
Share of FacebookExternalHit requests to sites protected by Transfon Security in the 7 days to 27 October 2026.
| United States | 56% |
| United Kingdom | 11% |
| Ireland | 4% |
| Germany | 3% |
| Australia | 3% |
| Singapore | 2% |
| Facebook, Inc. AS32934 | 72% |
| British Telecommunications PLC AS2856 | 2% |
| Cloudflare, Inc. AS13335 | 2% |
| Sky UK Limited AS5607 | 2% |
| Virgin Media Limited AS5089 | 1% |
2% of requests that used the FacebookExternalHit user agent came from networks FacebookExternalHit does not use, most often in United States, Ireland, Sweden. Scrapers borrow trusted crawler names to get past simple user agent allowlists, so allowing FacebookExternalHit by user agent alone also lets these through.
We have not confirmed whether FacebookExternalHit follows robots.txt. Add a rule, then check your logs to see that it stopped. robots.txt is a plain text file at the root of your domain, such as https://example.com/robots.txt.
User-agent: facebookexternalhit Disallow: /
User-agent: facebookexternalhit Disallow: /private/ Disallow: /search
User-agent: facebookexternalhit Allow: /blog/ Disallow: /
User-agent: facebookexternalhit Allow: / User-agent: * Disallow: /
User-agent: facebookexternalhit group, FacebookExternalHit ignores your User-agent: * rules, so repeat any that should still apply.facebookexternalhit from FacebookExternalHit's user agent; check Meta's own documentation if it publishes a different robots.txt name.Treat robots.txt as a statement of your policy, and enforce it where requests arrive.
FacebookExternalHit fetches pages when your links are shared or syndicated. Keep it allowed so previews and feeds work, but leave it out of page views and ad requests.
Transfon Security for publishersWhen ads or posts are shared, FacebookExternalHit fetches the landing page. Those hits are not clicks, so keep them out of campaign reports.
Transfon Security for advertisersProduct links shared in chats and feeds are fetched by FacebookExternalHit. Keep it allowed so previews show the right image and price.
Transfon Security for e-commerceAllow FacebookExternalHit on public pages so shared links preview well, and keep it off the app.
Transfon Security for SaaS and APIsrobots.txt is a request, not an enforcement. Transfon Security shows FacebookExternalHit by name in the Top Bots report, so you can see how often it visits and which pages it reads. Block or allow it with a User Agent rule, or slow it down with a rate limit decision rule.
Transfon Security
FacebookExternalHit is a bot in the link preview bots category, operated by Meta. The primary purpose of FacebookExternalHit is to crawl the content of an app or website that was shared on one of Meta’s family of apps, such as Facebook, Instagram, or Messenger. The link might have been shared by copying and pasting or by using the Facebook social plugin. This crawler gathers, caches, and displays information about the app or website such as its title, description, and thumbnail image.
We have not confirmed whether FacebookExternalHit follows robots.txt. Add a robots.txt rule, then check your logs to see that it stopped, and block it by user agent if it did not.
Add "User-agent: facebookexternalhit" followed by "Disallow: /" to the robots.txt file at the root of your site. To enforce it, block requests whose user agent contains "facebookexternalhit" at your WAF. In Transfon Security that is one User Agent block rule.
No. robots.txt is voluntary, so FacebookExternalHit may not follow it, and anyone can send FacebookExternalHit's user agent, so a fake FacebookExternalHit ignores your rule. Enforce the rule where requests arrive, at your WAF, and check the source network.
Link preview bots fetch a page when someone shares its URL in a chat app or social network, to build the preview card. Blocking them breaks your link previews, so keep them allowed but leave them out of analytics and ad requests.
Transfon Security identifies every bot in this directory in your traffic reports, flags fake search crawlers, and lets you allow, block or rate limit each bot.
Privacy, security, monetization, and performance insights. A few emails a month, no spam.