Link & Social Card Preview
Enter a public http(s) URL; the server fetches static HTML metadata under a strict SSRF policy and shows the status, final URL, title/description/canonical, Open Graph, Twitter fields and a static social card.Restricted server-side fetch
Operations
Real examples and limits
Only http/https on ports 80/443; userinfo, localhost, loopback, private, link-local, reserved and IPv4-mapped IPv6 addresses are refused. ALL DNS answers must be public; connections pin the validated IP while keeping the original Host/SNI. Every redirect is re-validated (max 3 hops); total 10s budget, separate connect timeout, 2 MiB decompressed HTML cap, process concurrency 4, bounded 10-minute cache. No target-page JS, no screenshots, no promise of matching platform caches. OG images start as a URL + placeholder; only a click triggers a backend-restricted fetch under the same policy. Logs never contain a full URL or query string; no query history is persisted by default.
FAQ
Who makes the request?
The site server makes the request; your browser only talks to the same-origin API. It never contacts the target directly.
Why are localhost / private addresses refused?
SSRF defence: userinfo, private/loopback/link-local/reserved IPs and IPv4-mapped IPv6 are refused; ALL DNS answers are validated and the connection pins the verified IP to prevent DNS rebinding.
Does the result match WeChat / X / Facebook cards?
No. Only static HTML metadata is read: no JS execution, no screenshots. Each platform has its own crawler and cache; equivalence with their final cached result is not promised.
Are OG images loaded automatically?
No. Initially only the URL and a placeholder appear. A click is required, and the backend re-applies the full policy before returning a decoded data: URL.
Is my query history stored or shared?
No history is persisted by default and no cross-user history list exists. The short in-process cache stores only sanitised metadata under a hash key, expires after 10 minutes and is capacity-bounded; logs contain no full URL or query string.
What if some fields are missing?
The result explicitly lists missing fields (title/description/canonical/openGraph/twitter). Empty fields stay empty; no guessed values are inserted.