Support

fbclid is a tracker parameter added there by Facebook. It does not have the form of a path and does not correspond to any file on your site so it can't trigger DFIShield (Direct File Inclusion prevention).

If you get an fbclid parameter on your site that corresponds to an existing file on your site or has the form of a path it is not legitimate (it does not come from Facebook). Someone is abusing it to attack your site and Admin Tools blocks them, as it should.

While you can circumvent this protection it'd beat the purpose of having Admin Tools. Once of the many ways Admin Tools protects you is by preventing the abuse of well known URL parameters such as the marketing / tracking identifiers added by ad networks and social media. In other words, attackers trying to fly under the radar might use one of these well known URL parameters with malicious content (URLs to malware or spam, files on your server, SQL injection, ...). To further muddy the waters they'd use the same User Agent as the legitimate site but with an IP address which does NOT belong to the legitimate site.

Also remember that one of the typical ways malicious actors would harvest potential target URLs is, of course, by what is being shared on social media. That's their second most used source. The first most frequently used source is web search results.

So, how sure are you that the fbclid you are getting blocked is legitimately coming from Facebook and not, in fact, an actual attack on your site?

Tell me what exactly is the Target URL you see. Last I checked fbcid was an alphanumeric identifier and social sharing worked on all my sites. I am wondering if there was something else in your URL which was being blocked in the same URL which means that fbclid is just a red herring.

The format of the fbclid is indeed what I read in Facebook's documentation and doesn't trigger the DFIShield. I think the URL you were trying with Facebook may have container a parameter like something=/ which would trigger DFIShield (a single forward slash is the root of the server's disk).

If it happens again please tell me what the Target URL is so we can help you further.