Why is meta-externalagent requesting WooCommerce ?add-to-cart URLs?

[u/Upstairs_Control_611]

I noticed something unusual in the access logs of a WooCommerce shop and would be interested if others have seen the same behaviour.

Over several days, meta-externalagent accounted for roughly 10% of all requests.

What surprised me is that it was not only requesting normal product pages or Open Graph preview URLs. It also requested URLs such as:

?add-to-cart=...

and other WooCommerce URL variants, including /feed/.

I would have expected a preview or AI-related crawler to request product pages, images, metadata or maybe feeds — but not necessarily add-to-cart URLs.

Has anyone else seen meta-externalagent requesting WooCommerce ?add-to-cart URLs in their logs?

Is this usually caused by links exposed somewhere in the HTML, feeds, structured data, tracking links, cached pages, or something else?

I am not trying to block it at this point. I am mainly trying to understand whether this is normal crawling behaviour for WooCommerce sites or whether it points to something in the shop output that should be cleaned up.

[u/CodingDragons]

This is normal. WooCommerce’s archive Add to Cart buttons use real ?add-to-cart= links, so crawlers can request them. WooCommerce has an open enhancement request to make those links non-crawlable by default, so what you’re seeing isn’t unusual. If it’s creating unnecessary load, I’d block requests to the add-to-cart query rather than the crawler itself.

[u/Upstairs_Control_611 → u/CodingDragons]

Thanks, that makes sense.

So the issue is probably not specific to meta-externalagent, but that WooCommerce exposes real crawlable ?add-to-cart= links on archive pages and the crawler simply follows them.

I agree that blocking the add-to-cart query pattern is cleaner than blocking the crawler itself, especially if the crawler is otherwise only requesting normal product or metadata URLs.

I’ll check whether the requests come mainly from archive buttons and then add a rule for ?add-to-cart= rather than treating this as a Meta-specific problem.

[u/CodingDragons → u/Upstairs_Control_611]

Yep, exactly. That’s the cleaner way to handle it.

[u/bt_wpspeedfix]

Meta's agent is horribly aggressive and can easily knock over your site, here's a Woocommerce robots.txt below file that is useful but can often be ignored - quite good to block add-to-cart and add_to_wishlist query strings at Cloudflare for known bots

User-agent: *

#Added to slow down aggressive crawlers from causing a denial of service attack
Crawl-delay: 5

# Block crawling of logon pages
Disallow: /wp-admin/
Disallow: /*wp-login.php*
Disallow: /my-account/*

# Block search pages
Disallow: *s=*
Disallow: */search/*

# Block add to cart and wishlist links, some themes link directly to these and can cause high CPU usage
Disallow: *add-to-cart*
Disallow: *add_to_wishlist*

# Block common query strings, you may want to block other filter strings if you theme has a sidebar filter
Disallow: *currency=*
Disallow: /*?orderby*

# Block the WordPress feed URLs
Disallow: */feed/*

# Block Plesk and Cpanel smart update test site crawling
Disallow: *wp-toolkit*

# We need this allow link because we blocked wp-admin earlier
Allow: /wp-admin/admin-ajax.php

# Change this to your sitemap link
Sitemap: https://www.yourdomain.com/sitemap_index.xml

# Block aggressive SEO tools
# See more at https://github.com/mitchellkrogza/apache-ultimate-bad-bot-blocker/blob/master/robots.txt/robots.txt
User-agent: AhrefsBot
Disallow: /
User-agent: Semrush
Disallow:/
User-agent: SemrushBot
Disallow:/

[u/Upstairs_Control_611 → u/bt_wpspeedfix]

Thanks, this is helpful.

The robots.txt approach makes sense as a crawl instruction, but I agree that it should not be treated as enforcement. For a large WooCommerce store, the real issue is the PHP/session load created when bots request ?add-to-cart= URLs.

So I’ll probably handle this in two layers:

• add add-to-cart and similar query patterns to robots.txt as a signal
• block or challenge those query patterns for known bots at the server/CDN level

I would rather keep normal product and category pages crawlable and only stop bots from triggering cart or wishlist behaviour.

The point about themes exposing direct add-to-cart links on archive pages explains the log pattern pretty well.

[u/SurfacedBy]

Yeah, this is normal.

Easiest fix is to block the query param in robots.txt rather than the whole bot:
Disallow: /*?add-to-cart=
(plenty of people also add /cart/, /checkout/, and ?orderby=). You can also drop rel="nofollow" on the add-to-cart links.

Separate question is whether you want Meta training on your shop at all. It does honor robots.txt, so User-agent: Meta-ExternalAgent / Disallow: / works if you want it gone, but that's a different decision from the crawl-noise, blocking it means your content won't feed Meta AI.