FacebookExternalHit user agent
Operated by Meta
FacebookExternalHit is Meta's fetcher that builds link previews when a URL is shared on Facebook, Instagram, Messenger or WhatsApp.
The FacebookExternalHit bot at a glance
- FacebookExternalHit is operated by Meta and reads page titles, descriptions and images to build link previews.
- The robots.txt token for FacebookExternalHit is facebookexternalhit.
- Blocking a social preview bot has no effect on search rankings.
- FacebookExternalHit robots.txt support: Yes.
- Recommendation for Generative Engine Optimization (GEO): Allow.
What is FacebookExternalHit?
FacebookExternalHit reads a shared page’s title, description and Open Graph image to build the preview card.
Blocking it breaks link previews across Meta’s apps, which usually lowers clicks from social shares. Meta notes it may bypass robots.txt when running security or integrity checks.
Should you block FacebookExternalHit?
Allow FacebookExternalHit unless it causes a measurable load problem.
| Effect on search rankings | Blocking a social preview bot has no effect on search rankings. |
|---|---|
| Effect on AI visibility | No direct effect on AI answers, but shared links lose their title, image and description, which usually lowers clicks from social and chat apps. |
| Follows robots.txt | Yes |
| Recommendation | Allow |
How to block or allow FacebookExternalHit
Put the robots.txt rule in the file at the root of every domain and subdomain, for example https://example.com/robots.txt. The token facebookexternalhit is matched case-insensitively.
robots.txt: block
# Block FacebookExternalHit
User-agent: facebookexternalhit
Disallow: /robots.txt: allow
# Allow FacebookExternalHit
User-agent: facebookexternalhit
Allow: /robots.txt: partial
# Keep FacebookExternalHit out of private areas only
User-agent: facebookexternalhit
Disallow: /wp-admin/
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Allow: /Nginx
# Nginx: return 403 to FacebookExternalHit
if ($http_user_agent ~* "(facebookexternalhit)") {
return 403;
}Apache
# Apache .htaccess: return 403 to FacebookExternalHit
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (facebookexternalhit) [NC]
RewriteRule .* - [F,L]Cloudflare WAF
# Cloudflare > Security > WAF > Custom rule, action: Block
(http.user_agent contains "facebookexternalhit")How to verify real FacebookExternalHit traffic
Meta publishes no IP list or reverse DNS pattern for FacebookExternalHit, so the user agent cannot be verified. Anyone can send the same string. Rate-limit unusual volume instead of trusting the name.
How to find FacebookExternalHit in your server logs
Search the web server access log for the token. The command below counts FacebookExternalHit requests per URL on Nginx or Apache.
grep -i "facebookexternalhit" access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20For a full report per AI bot, upload the log to the AI Log File Analyzer, a free tool by Justin Hà.
FacebookExternalHit user agent string
The full user agent Meta publishes for FacebookExternalHit. Version numbers such as Chrome/W.X.Y.Z change over time, so match the token, not the whole string.
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)FacebookExternalHit FAQ
FacebookExternalHit identifies itself with the robots.txt token "facebookexternalhit". A typical request header reads: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Yes. Meta states that FacebookExternalHit follows robots.txt rules written for the "facebookexternalhit" token.
Blocking a social preview bot has no effect on search rankings. No direct effect on AI answers, but shared links lose their title, image and description, which usually lowers clicks from social and chat apps.
Add two lines to the robots.txt file at the root of each domain and subdomain: "User-agent: facebookexternalhit" followed by "Disallow: /". The token is case-insensitive. Changes can take up to 24 hours to be picked up.
Not reliably. Meta publishes no IP list or reverse DNS pattern for FacebookExternalHit, so anyone can send the same user agent. Rate-limit unusual volume instead of trusting the name.
Search your server access log for "facebookexternalhit", for example with: grep -i "facebookexternalhit" access.log. The AI Log File Analyzer by Justin Hà counts visits per AI bot from an uploaded log file.
Sources: Meta crawler documentation. Last reviewed by Justin Hà.
See which of these bots actually reach your website
The AI Log File Analyzer by Justin Hà counts visits from GPTBot, ClaudeBot, PerplexityBot and other AI crawlers in your server log, for free. The GEO Technical Package sets up robots.txt, llms.txt and crawler access for AI search.
