facebookexternalhit blocked by automatic DDoS Mitigation on Hobby project

Help
1

Hi Vercel team,

Hobby plan, project “primex” (team zv5jrjrqw8-1039s-projects, project ID
prj_2S6n5cPcTEdkFzd6zeCAdjvKwfzg). Subdomain gamsat.primexstudy.com.au.

Issue: Facebook’s social-card scraper (facebookexternalhit) is being
challenged at the edge by your automatic DDoS Mitigation. Meta’s Sharing
Debugger consistently returns HTTP 403 with the misleading “could be due
to robots.txt block” hint. Net effect: every shared GAMSAT link renders
a broken or hostname-only OG card on Facebook, Messenger, and WhatsApp.

What I have ruled out:

  • robots.txt: explicitly allows facebookexternalhit / Twitterbot /
    LinkedInBot / Slackbot-LinkExpanding / WhatsApp / TelegramBot
  • Application-layer block: direct curl with facebookexternalhit/1.1 UA
    from my IP returns 200 OK
  • Custom Firewall Rule: I added one matching User-Agent contains
    facebookexternalhit etc. with action Bypass. It does not help because
    the system DDoS Mitigation runs before Custom Rules in the execution
    order, so the request is rejected before my rule fires
  • LinkedIn Post Inspector and direct shares: work fine, return 200
  • Vercel Firewall Overview: shows ~41 Challenged requests per hour from
    the DDoS Mitigation rule, matching the FB scrape attempts

What I would like:
Could you whitelist Facebook’s published facebookexternalhit IP ranges
at the system level for this project, so the scraper can fetch OG meta
without hitting the IP-based DDoS challenge?

The Pro plan System Bypass Rules feature would let me do this myself by
adding the CIDR ranges, but I am running a hobby-stage launch and would
prefer not to upgrade just for this single issue if a manual whitelist
is feasible.

Verified working as expected:

  • LinkedIn cards render correctly
  • Twitter/X cards re-fetch on share
  • Direct curl from outside Vercel’s PoPs returns 200

Thanks!

1 Like