1. Home
  2. Products
  3. Social card preview
  4. API
  5. Checks
  6. image.refused-allowlisted

image.refused-allowlisted

Image refused to the API's crawler, probe served. Level: Warning.

When it is raised

The API's crawler (PolymorphismOGPreview/1.0, or the user agent chosen with ?ua=) requested the image URL, followed at most 7 redirects (8 requests), and got HTTP 401 or 403. The API then sent a second GET (the probe) for the same URL from its own server with the user agent facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php); the probe also follows at most 7 redirects (8 requests) and stops reading once more than 1,024 bytes have arrived. The probe also sends a different Accept header (text/html,application/xhtml+xml instead of image/*). Raised when the probe ends in a 2xx status. The probe response's content type is not checked, so an HTML page returned with status 200 also counts.

What it does to a shared link

The image host answered the probe, which carries the facebookexternalhit/1.1 user agent, with a success status and refused the API's crawler, so it treats the two requests differently; they differ in user agent and Accept header. Any client refused in the same way cannot fetch the image. No dimensions, size, format or crop could be measured, because the API's crawler received no image.

How to fix it

  1. Find the rule that refuses the image: a bot filter, firewall or CDN setting on the image host that only lets through a list of known user agents.
  2. Serve images used in og:image or twitter:image to every client, without requiring cookies, a login or a recognised user agent.
  3. If the host cannot be changed, move the card image to a host that serves it publicly and point the tag at the new URL.
  4. Confirm the result by requesting the image with GET and an unlisted user agent, following redirects, and checking for status 200.
curl -sL -o /dev/null -w "%{http_code}\n" -A "ExampleBot/1.0" https://example.com/card.png # expect: 200

Related checks

Sources