403 on 'shortten.net' vs 200 OK on 'shortn.icu' (Same Code)

Help
1

Hello Vercel Team,
I am experiencing a critical issue where Facebook’s crawler (facebookexternalhit) is being blocked with a 403 FORBIDDEN error when trying to scrape Open Graph (OG) meta tags from my site.
This block prevents all Facebook link previews from working, but it only happens on one specific domain.
I have multiple domains pointing to this exact same Vercel project and same codebase. Here is the proof that my code is working correctly, and the issue is specific to Vercel’s handling of my shortten.net domain:
Test 1: FAILED DOMAIN
• Domain: https://shortten.net
• Test URL: https://shortten.net/tV2hR2G
• Facebook Debug Result: 403 FORBIDDEN
• Outcome: Facebook crawler is blocked. No OG tags can be read.
Test 2: WORKING DOMAIN (Same Project)
• Domain: https://shortn.icu
• Test URL: https://shortn.icu/NM8TF9Z
• Facebook Debug Result: 200 OK
• Outcome: Success! Facebook correctly scrapes my custom og:title (“INI LEWAT PINTU NET”) and og:image.
Test 3: WORKING DOMAIN (Same Project)
• Domain: https://funhun.site
• Test URL: https://funhun.site/tV2hR2G
• Facebook Debug Result: 200 OK
• Outcome: Success! Facebook correctly scrapes the exact same content that was blocked on shortten.net.
Conclusion
This comparison proves:

  1. My Vercel deployment and codebase (server.js, EJS rendering, etc.) are 100% correct.
  2. My server is perfectly serving the 200 OK response with the correct og:tags (as seen on shortn.icu and funhun.site).
  3. The problem is isolated entirely to the shortten.net domain.
    My best guess is that Vercel’s internal security or reputation system has automatically flagged shortten.net (perhaps because it’s new or contains the word “shorten”) and is applying a high-level IP-based block against Facebook’s crawler.
    I have already set a Custom Firewall Rule in my Vercel dashboard to Bypass the facebookexternalhit User-Agent, but this system-level block seems to be ignoring my rule.
    My Request:
    Could you please investigate the internal reputation/security flag on my domain shortten.net and remove this block? I need Facebook’s crawler to be able to access my site to generate link previews, just as it does on my other domains.
    Thank you for your help.
2

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

You can also use v0 to narrow down the possibilities.

5

The traffic is being challenged by Vercel Firewall, which can happen if the traffic matches a spam-like pattern

If you adjust your bot protection to Log instead of Challenge it will let these through, though malicious bots will get through as well.

I attempted to use https://opengraph.xyz to check your OG images and got the same checkpoint, which you should be able to see in your firewall logs having a user agent containing OpenGraphXYZBot/1.0. If you add this user agent to the firewall rule, it should unblock it correctly.

To get the matching user agent that Facebook’s crawler is using, you can run the check multiple times with different query params and then check the challenged traffic for the user agent

image
image1032×772 22.3 KB