Meta Sharing Debugger receives 403 while Facebook crawler gets 200

Project: smakfin-web
Domain: https://dev.smakfin.cz/blog/test-facebook-propojeni-01

Meta Sharing Debugger consistently reports HTTP 403.

Verified:
- robots.txt explicitly allows facebookexternalhit and Facebot
- curl with the complete Meta user agent returns HTTP 200:
  facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
- Open Graph metadata is server-rendered and valid
- Bot Protection is Off
- AI Bots are Allow
- Attack Mode is Off
- There are no custom Firewall rules, blocked IPs, or Firewall events

The Vercel AI support suggested a Custom WAF bypass for ASN 32934,
but the dashboard explicitly states that Custom Bypass Rules do not bypass
system mitigations. System Bypass Rules are unavailable on the Hobby plan.

Could Vercel investigate a possible platform-level DDoS mitigation false
positive affecting Meta crawler traffic for this domain?

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

This is not an abuse report and does not concern illegal or malicious activity.

The linked Abuse form is not applicable. I need help investigating a possible false-positive Vercel system-level DDoS mitigation block affecting Meta's facebookexternalhit crawler. Could a Vercel team member route this to the appropriate platform support channel, or confirm whether this requires upgrading to Pro for investigation?

Snímek obrazovky 2026-08-06 v 14.19.21

Snímek obrazovky 2026-08-07 v 9.16.27

Project: smakfin-web
Domain: https://dev.smakfin.cz/blog/test-facebook-propojeni-01

Meta Sharing Debugger consistently reports HTTP 403.

Verified:
- robots.txt explicitly allows facebookexternalhit and Facebot
- curl with the complete Meta user agent returns HTTP 200:
  facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
- Open Graph metadata is server-rendered and valid
- Bot Protection is Off
- AI Bots are Allow
- Attack Mode is Off
- There are no custom Firewall rules, blocked IPs, or Firewall events

The Vercel AI support suggested a Custom WAF bypass for ASN 32934,
but the dashboard explicitly states that Custom Bypass Rules do not bypass
system mitigations. System Bypass Rules are unavailable on the Hobby plan.

Could Vercel investigate a possible platform-level DDoS mitigation false
positive affecting Meta crawler traffic for this domain?