NORAD.io
OVERVIEWCOUNTRIESBOTSTHREATS

FACEBOOKBOT

LOW RISK🔍 SEARCH & AI CRAWLER

Meta's crawler that fetches pages for link previews on Facebook and Instagram

ORGANIZATION
Meta
FIRST SEEN
2011-01
RESPECTS ROBOTS.TXT
✓ YES
DOCUMENTATION
developers.facebook.com
—
DAILY VISITS
—
COUNTRIES ACTIVE
TRACKING
STATUS
—
LAST SEEN

📡 FACEBOOKBOT USER-AGENT STRING

facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)

This is the User-Agent header sent by FacebookBot in HTTP requests. Use this to identify FacebookBot in your server access logs.

📋 ABOUT FACEBOOKBOT

FacebookBot (officially 'facebookexternalhit') is Meta's web crawler responsible for generating link previews across Facebook, Instagram, Messenger, and WhatsApp. Whenever a user shares a URL on any Meta platform, FacebookBot fetches the page to extract Open Graph meta tags and generate a rich preview card with title, description, and image.

FacebookBot is one of the most commonly seen bots in server logs due to the massive scale of link sharing across Meta's platforms. Its traffic pattern is user-driven rather than systematic — each request corresponds to a real user sharing or viewing a link. The bot reads Open Graph (og:title, og:description, og:image) meta tags and falls back to standard HTML meta tags when OG tags aren't present.

NORAD.io tracks FacebookBot activity to help site operators monitor social sharing patterns and ensure their Open Graph implementations are working correctly. While FacebookBot is low-risk, distinguishing it from Meta-ExternalAgent (Meta's AI training crawler) is increasingly important for content licensing decisions.

🎯 HOW TO DETECT FACEBOOKBOT

  • ▸User-Agent is 'facebookexternalhit/1.1' — note the specific format
  • ▸Requests are triggered by user link-sharing activity
  • ▸Looks for Open Graph (og:) meta tags specifically
  • ▸Fetches og:image URLs in addition to the page HTML
  • ▸Verify IPs resolve to Facebook's network ranges

🌐 FACEBOOKBOT KNOWN IP RANGES

69.63.176.0/2066.220.144.0/2066.220.152.0/2169.171.224.0/19

Use these CIDR ranges to verify FacebookBot identity at the network level. Always combine with User-Agent verification for accurate detection.

🔄 CRAWL BEHAVIOR

On-demand crawling triggered when users share links on Facebook, Instagram, or Messenger. Also periodically re-fetches previously shared URLs to update cached previews. Reads Open Graph meta tags for rich previews.

PURPOSE

Fetches web pages to generate rich link previews (title, description, image) when URLs are shared on Facebook, Instagram, Messenger, and other Meta platforms.

🤖 ROBOTS.TXT CONFIGURATION

User-agent: facebookexternalhit
Allow: /

# Blocking this will prevent link previews on Facebook/Instagram

FacebookBot respects robots.txt directives. Add this to your robots.txt file at the root of your domain.

→ Complete Guide: robots.txt for AI Bots

🗺️ WHERE IS FACEBOOKBOT ACTIVE?

🇺🇸
United States
🇨🇦
Canada
🇲🇽
Mexico
🇬🇹
Guatemala
🇨🇺
Cuba
🇭🇹
Haiti
🇩🇴
Dominican Republic
🇭🇳
Honduras
🇳🇮
Nicaragua
🇸🇻
El Salvador
🇨🇷
Costa Rica
🇵🇦
Panama

⚠️ RELATED THREATS

Prompt Injection

Attempts to override bot instructions via malicious content embedded in web pages

Data Exfiltration

Bots attempting to extract sensitive data from websites including PII and credentials

Credential Stuffing

Automated login attempts using leaked credentials from data breaches

Aggressive Content Scraping

Bots aggressively scraping content beyond robots.txt limits and ToS

🔗 RELATED BOTS

Meta-ExternalAgentMEDIUM

Meta · Meta's AI training crawler — collects web data for Meta's LLaMA and AI models

📂 MORE 🔍 SEARCH & AI CRAWLERS

GPTBotOpenAIClaudeBotAnthropicGooglebotGoogleGoogle-ExtendedGoogleBingbotMicrosoftBytespiderByteDance

📚 RELATED GUIDES

How to Detect AI Bots →robots.txt for AI Bots →NORAD API Docs →

PROTECT YOUR WEBSITE

Deploy SiteTrust to monitor and control AI bot access to your site with the Agent Passport Standard.

INSTALL SITETRUST →