Hello Vercel Community,
I’m having an issue where Meta/Facebook Sharing Debugger returns HTTP 403 for my Vercel production site, even though the site is publicly accessible and curl returns 200.
Project:
VILM
Production domain:
Test URLs:
https://www.vilm.jp/robots.txt
Issue:
Meta/Facebook Sharing Debugger returns HTTP 403 for:
The debugger says the URL returned an error HTTP status code and suggests it could be related to robots.txt, but robots.txt allows facebookexternalhit and Facebot.
What I verified:
- Browser access to https://www.vilm.jp works normally.
- https://www.vilm.jp/ogp.png loads correctly.
- VILM is a fully static HTML file under /public with explicit Open Graph tags.
- curl -I VILM returns HTTP/2 200.
- curl with a facebookexternalhit-like User-Agent also returns HTTP/2 200:
curl -I -A “facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)” VILM - https://www.vilm.jp/ogp.png also returns HTTP/2 200.
- robots.txt is public and allows facebookexternalhit and Facebot.
- Vercel runtime/app logs do not show matching Meta/Facebook requests.
- Vercel Firewall Overview and Audit Log show no visible activity during the relevant time.
- I previously saw a firewall-related indication with sys_dos_mitigation, but I cannot confirm if it is related.
Additional context:
The Vercel AI assistant checked my project-level firewall and bot protection settings and said they do not appear to be blocking Meta/Facebook crawlers. It suggested this may be related to Vercel’s system-level DDoS mitigation before requests reach my application.
Question:
Could this be a false positive from Vercel Edge / DDoS Mitigation affecting Meta/Facebook crawler IPs?
Is there anything I can do on a Hobby plan to resolve this, or does this require Vercel support / Pro plan / system-level allowlisting?
Thank you.
