Facebook Sharing Debugger returns 403 – Meta crawler blocked by Vercel DDoS mitigation

Help
1

Facebook Sharing Debugger returns HTTP 403 for my Vercel Hobby project.

Domains: https://www.fotovideorubin.com/ ; https://fotovideorubin.com/

Both URLs return 403 in Meta Sharing Debugger.

What I already checked:

  • robots.txt explicitly allows:
    • facebookexternalhit
    • meta-externalfetcher
  • Open Graph tags are present
  • Production deployment is active and domain configuration is valid
  • Bot Protection is inactive
  • No custom firewall rules are configured
  • Deployment Protection should not affect the production custom domain

In the Vercel Firewall dashboard, I can see denied requests and DDoS Mitigation events around the same time I trigger “Scrape Again” in Facebook Sharing Debugger.

The Vercel Agent also confirmed that the 403 errors are almost certainly caused by automatic DDoS mitigation mistakenly flagging Meta’s crawlers, and that this requires platform-level intervention.

Could someone from Vercel please investigate or advise how this can be resolved on a Hobby project?

2

Hey there! Thanks for posting this.

Since the Shared Debugger is a third-party tool, it can be difficult to pin this down.

  • When running a curl against the URLs using the crawler user-agents, we are seeing 200 responses
  • We also did not see hits against our firewalls from the Facebook crawler (other than the curl tests)

As a few quick troubleshooting steps:

  • Can you try clicking ‘Scrape again’ multiple times to clear any potential cache within the Facebook Shared Debugger?
  • Can you try using variations of your domain (e.g. with www subdomain and with just the apex) to see if you are seeing the same 403 responses?
  • Can you try sharing the link directly on a Facebook post to see if it correctly generates the OG tags when shared?
    • This is the most accurate reflection of the user experience, and may help isolate the issue to just the Shared Debugger.

If you are still seeing the issue, to help us investigate further, can you please share a request-id from the Shared Debugger when it gives the 403 ?