facebookexternalhit gets 403 on my custom domain even with a Bypass rule (Hobby)

Hi! Link previews for my site don't show up in Messenger or Instagram, and I think Meta's crawler is being blocked before it reaches my project.

What's happening Meta's Sharing Debugger returns 403 for https://www.offband.pro, with the "could be due to a robots.txt block" message. I've pressed Scrape Again several times over a couple of days.

Off Band

Off Band | Your own internet radio dial

Listen to free internet radio stations from around the world. Save the ones you like to your own dial, flick between them or shuffle. No account needed.

What I've checked

robots.txt allows everything, and I added facebookexternalhit explicitly Bot Protection is off, AI Bots are set to Allow, and Attack Mode is off I added a custom firewall rule, User Agent contains facebookexternalhit → Bypass. It's live, and Meta still gets 403 The same request with Meta's user agent and Range header returns 200/206 when I send it myself Every other preview works: X, iMessage, WhatsApp, Slack, Discord and LinkedIn all show the image The OG tags are in the head and use full URLs. The image is a 1200×630 JPG, 204 KB Setup Next.js 16 (App Router) on Vercel, Hobby plan. Custom domain www.offband.pro, with the apex redirecting to www.

From other threads here, this looks like the system DDoS mitigation flagging Meta's crawler IPs, which a project rule can't bypass on Hobby. Could someone from the team take a look at the mitigation for this domain? Or is there anything else I can try on my end?

Thanks a lot 🙏

If the Firewall → Traffic log showed no facebookexternalhit requests when you pressed Scrape Again, add that line to the list. It's the strongest evidence that the block happens before your firewall.