Every link preview you’ve ever seen was built by a crawler. Someone pastes your URL into Slack or iMessage, the platform sends a bot to fetch the page, reads the Open Graph tags out of the head, and draws the card. No fetch, no card.
Bot protection sits directly in that path. The same rules that stop scrapers and credential stuffers look at a preview crawler and see exactly what they’re built to kill: an unfamiliar agent, no cookies, no mouse movement, a datacenter IP. So the connection dies before a byte of HTML leaves your server, and the platform quietly falls back to rendering your link as plain text.
We see this constantly on big sites. United Airlines never completes a request for us at all; the socket closes before a response arrives. Their tags might be perfect. Nobody will ever know, including their own marketing team.
The tl;dr: bots need to read your pages for links to work anywhere. If your protection blocks them, your links are busted, full stop.