npm's bot protection blocks the crawlers that build previews

Fetching npmjs.com gets a Cloudflare interstitial, not a package page. Millions of shared package links, unreadable.

So package links depend on the wall's mood

Whether a shared package unfurls depends on which crawlers Cloudflare lets through today.

No preview — the request never completes

npmjs.com

https://www.npmjs.com

What's actually wrong

Fetching npmjs.com without a full browser gets Cloudflare's "Just a moment" interstitial instead of the page. That's bot protection doing its job against scrapers, but preview crawlers arrive the same way and get the same wall. npm is owned by GitHub, which is owned by Microsoft; package pages are linked from READMEs, release notes, and every JavaScript tutorial ever written, and each of those links has to get past the wall before a single tag can be read.

This is cause 1 of the 5 ways link previews break. The full breakdown covers the manual fix and the automatic one.

GET npmjs.com/package/express → 'Just a moment…' interstitial

the page title crawlers see is Cloudflare's, not the package's

cards below render without touching npmjs.com

What that costs downstream

The registry's links are the docs

Package pages are JavaScript's reference library. Links that can't unfurl make the canonical source look less legitimate than a random blog covering the same package.

Maintainers can't fix it

A package author has zero control over npm's WAF. Their launch posts inherit whatever the wall does that day.

Nobody can check millions of links

With millions of packages, nobody at npm is testing how each one unfurls. Blocked crawlers fail silently at registry scale.

The package, designed rather than scraped

Every value here is supplied by the template. No page load required.

npm

Package pages, as cards

The links in every README and release note.

A package on Twitter

The link from a release announcement.

npm · express

Fixed by OpenGraph+

No preview — the request never completes

npmjs.com

https://www.npmjs.com

Today the crawler hits the wall

For whoever owns the templates

The wall is configurable

Cloudflare can allowlist verified bots. Preview crawlers are a category in its own settings; letting them through is a toggle, not a rebuild.

Scale makes it invisible

No team pastes millions of package links into chats to check them. Monitoring crawler access is the only way to see this class of failure.

Or serve from outside the wall

OpenGraph+ renders and hosts the card image, so the preview resolves from a domain the WAF isn't guarding.

Is your site doing this too?

Run the same check we ran on npm: every platform, every page we can find, free.

Working on something big? Talk to a person