← Blog

Cloudflare Blocking Your Link Preview? Here's Why

Your OG tags are correct. Your image loads fine in a browser. But Discord, Facebook, or Slack won't show a preview since you put the site behind Cloudflare. This is usually not a tag problem or a cache problem. It's Cloudflare's bot protection treating the crawler as an attacker.

Not sure if Cloudflare is even the cause?

Check it free with Proovd to see what your site actually returns to a crawler, then compare that to what a browser sees.

Quick Answer

  • Bot Fight Mode and "I'm Under Attack Mode" are the most common causes of broken previews after adding Cloudflare
  • Both features challenge traffic that looks automated, and social preview crawlers look automated by design
  • Bot Fight Mode cannot be bypassed with a normal WAF rule. It runs outside the regular rules engine

The Pattern People Actually Report

This isn't a theoretical edge case. On Cloudflare's own community forum, one developer described their og:image working fine over HTTP but failing over HTTPS after putting the site behind Cloudflare. The fix was disabling "Under Attack Mode." Another thread is titled plainly: "Cloudflare blocking Facebook, how to fix it," and again the cause was Under Attack Mode. A third developer asked directly whether Bot Fight Mode blocks Facebook and X when links get shared, since they had no other explanation for previews suddenly breaking.

The common thread: nothing changed about the site's HTML or OG tags. The only new variable was Cloudflare's security layer sitting in front of the origin server.

Why This Happens

Under Attack Mode challenges every visitor, including bots you want

Under Attack Mode shows every visitor a JavaScript challenge page before letting the request through. Social preview crawlers, like Discord's or Facebook's, don't run JavaScript and can't solve that challenge. They see the challenge page instead of your actual HTML, and no OG tags means no preview.

Bot Fight Mode scores traffic and challenges anything that looks automated

Bot Fight Mode is on by default on Cloudflare's Free plan. It identifies requests matching known bot patterns and issues a computational challenge. A crawler that fetches a page once, doesn't load images or run scripts, and has no browser fingerprint matches that pattern closely, which is exactly what a link preview bot looks like from the outside.

Cloudflare's own documentation confirms Bot Fight Mode cannot be bypassed or skipped using WAF custom rules or Page Rules, since it runs in a separate evaluation pipeline. If it's blocking your crawler, a normal allow rule will not fix it. You either turn it off or upgrade to Super Bot Fight Mode, which does support exceptions.

Verified bots get an exception. Most social crawlers don't automatically qualify

Cloudflare maintains a verified bot list for services like Googlebot and Bingbot that get to skip challenges. Not every social platform's preview crawler is guaranteed to be on that list by default, which is why previews can break even when your site is otherwise reachable.

Step-by-Step Fix Guide

  1. Check whether Under Attack Mode is currently on, under Security in your Cloudflare dashboard. If it is, turn it off and re-test the preview
  2. Go to Security > Events and filter for actions labeled "Bot Fight Mode." If you see the crawler's requests being challenged or blocked there, that confirms the cause
  3. If you're on a Free plan, temporarily disable Bot Fight Mode and re-test. If the preview works immediately after, that was it
  4. If you're on Pro or above, switch to Super Bot Fight Mode instead, which lets you add a Skip rule for known social crawlers rather than turning off protection entirely
  5. Add a custom rule that allows requests from verified bots and known social preview user agents (Discordbot, facebookexternalhit, Slackbot, TwitterBot) to skip the challenge
  6. Re-verify the fix with Proovd

Cloudflare Security Settings That Commonly Break Previews

Setting Available on Can you add exceptions?
Under Attack Mode All plans No, it challenges everyone equally
Bot Fight Mode Free and above No, cannot be skipped with WAF rules
Super Bot Fight Mode Pro and above Yes, supports Skip rules per bot category
Custom WAF rules All plans Yes, fully configurable

If It Isn't Bot Protection

If Under Attack Mode and Bot Fight Mode are both off and the preview is still broken, the next most likely cause is a stale edge cache serving old HTML, or the WAF blocking the crawler's user agent through a custom rule someone else set up. Check response headers directly instead of guessing:

curl -I -A "facebookexternalhit/1.1" https://yoursite.com/page

A 403 or a challenge page in the response means the crawler is still being blocked somewhere in your Cloudflare configuration. A 200 with the correct tags means the block has been resolved and any remaining issue is on the platform's side. See our guide to clearing OG cache on every platform for that next step.

Quick Fix Checklist

  1. Checked Security > Events for Bot Fight Mode actions against crawler requests
  2. Confirmed whether Under Attack Mode is currently enabled
  3. Temporarily disabled Bot Fight Mode to test whether it's the cause
  4. Added a Skip rule in Super Bot Fight Mode for known social crawlers, if available on your plan
  5. Tested with curl using the crawler's actual user agent string
  6. Verified the final result with Proovd

Frequently Asked Questions

Does Bot Fight Mode block Facebook and Discord crawlers?

It can. Bot Fight Mode challenges traffic that matches known bot patterns, and social media preview crawlers match those patterns. Developers on Cloudflare's own community forum have reported exactly this.

Why did my link preview work before I added Cloudflare?

If your OG tags didn't change, Cloudflare's security layer is the new variable. Under Attack Mode and Bot Fight Mode are the most common causes.

Related Articles

Confirm what your site returns to a crawler

Check it free with Proovd to see exactly what's being served, independent of Cloudflare's dashboard or any platform's own cache.