@stefan look, i bet that meta has a link crawler somewhere, you would need to harden both things described... It might be just simpler to add metas ip ranges to the firewall
So I heard a few days ago that it might beneficial to activate authorized fetch mode so meta/facebook have a harder time reaching ones instance...
I thought of enabling that, though are there any drawbacks for other instances I should consider? Like having federation problems with certain software etc