facebookexternalhit gets 403 on my custom domain even with a Bypass rule (Hobby)

Hi! Link previews for my site don't show up in Messenger or Instagram, and I think Meta's crawler is being blocked before it reaches my project.

What's happening Meta's Sharing Debugger returns 403 for https://www.offband.pro, with the "could be due to a robots.txt block" message. I've pressed Scrape Again several times over a couple of days.

Off-Band

Off-Band | Your own internet radio dial

Listen to free internet radio stations from around the world. Save the ones you like to your own dial, flick between them or shuffle. No account needed.

What I've checked

robots.txt allows everything, and I added facebookexternalhit explicitly Bot Protection is off, AI Bots are set to Allow, and Attack Mode is off I added a custom firewall rule, User Agent contains facebookexternalhit → Bypass. It's live, and Meta still gets 403 The same request with Meta's user agent and Range header returns 200/206 when I send it myself Every other preview works: X, iMessage, WhatsApp, Slack, Discord and LinkedIn all show the image The OG tags are in the head and use full URLs. The image is a 1200×630 JPG, 204 KB Setup Next.js 16 (App Router) on Vercel, Hobby plan. Custom domain www.offband.pro, with the apex redirecting to www.

From other threads here, this looks like the system DDoS mitigation flagging Meta's crawler IPs, which a project rule can't bypass on Hobby. Could someone from the team take a look at the mitigation for this domain? Or is there anything else I can try on my end?

Thanks a lot 🙏

If the Firewall → Traffic log showed no facebookexternalhit requests when you pressed Scrape Again, add that line to the list. It's the strongest evidence that the block happens before your firewall.

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

https://vercel.com/docs/domains/troubleshooting

vercel.com

Troubleshooting domains

Learn about common reasons for domain misconfigurations and how to troubleshoot your domain on Vercel.

Update: with Logs in Live mode (no filters except path /), pressing "Scrape Again" in Meta's Sharing Debugger produces no request at all in my project's logs, while the debugger reports 403. Other visitors and crawlers show up normally with 200. My project firewall shows facebookexternalhit as allowed via a Bypass rule, Bot Protection is off, and there are no persistent actions. So Meta's crawler is being blocked at Vercel's edge before reaching the project. Can someone check the platform-level mitigation for www.offband.pro?