Twitter card validator for a live URL or the HTML you paste

01Fetch a URL or paste a head and see the card X resolves

Two ways in. Type an https URL and press Fetch, and a relay the author of this site runs on workers.dev makes one GET, follows at most five redirects, keeps at most 1 MB and hands the served HTML back to this page, which then parses it exactly as if you had pasted it. Or paste the served HTML of any page, a whole document or just the head, and press Validate. Paste mode makes no request of any kind. The result names the value X would resolve for each card field, says whether it came from the twitter tag, the Open Graph fallback or nowhere, draws both card shapes, and lists every finding with the source line it rests on.

Nothing you paste is stored anywhere. The one request in fetch mode carries the URL you typed and nothing else. Loading the image is a second request, from your browser straight to the image host, and it happens only after you validate, on the setting you choose above. Neither box in the preview is a pixel accurate render of any X client, because X staff removed the preview from their own validator on the grounds that the previews did not match what the clients displayed.

02What X reads, in order, and what it falls back to

X staff give the minimum as at least a twitter:card meta tag specifying a valid card type, or suitable Open Graph fallback tags, which is why the tool resolves each value twice, once from the twitter name and once from the Open Graph property. The HTML Standard says a meta element with a name attribute sets document metadata as a name and value pair, and it permits anyone to create metadata name extensions with no requirement to register them, so the twitter names are not defined by the standard at all. X carries the twitter names on the name attribute in its own player sample and in the served HTML of its developer documentation, and that same page ships og:locale on a name attribute rather than the property attribute the Open Graph protocol uses. So the tool reads both attributes and reports the mix rather than failing it.

03What 58 major homepages actually ship

58 homepages returned HTTP 200 with served HTML and were measured on 2026-09-06 by one direct HTTPS GET per host, redirects followed, with the first 2 MB of the response kept, from the fixed host list of the earlier robots census on this site. A tag counts as any meta element whose property or name attribute starts with og: or twitter:, matched case insensitively in the served HTML before any script runs. The raw file is published beside this page.

40 of those 58 homepages carry a twitter:card tag and 43 carry at least one twitter name of any kind. Among the hosts with a card, 25 set summary_large_image and 13 set summary. The gap worth looking at is the fallback. 11 carry a card tag with no twitter:title, so the title on those cards comes from og:title or from nothing, and 6 carry a card tag with neither twitter:image nor og:image. Alt text is the rarest thing on the list, present on 3 of the 58.

Every figure in this table is read from homepage-tag-census-2026-09-06.json, published beside this page on the same origin, capture date 2026-09-06, and none of them was typed by hand. Section 07 describes the recount that checked them.

04The validator X used to run

On 2026-09-06 a GET of https://cards-dev.x.com/validator returned HTTP 307 with a Location header pointing at the twitter.com login page, carrying the validator URL as the redirect_after_login parameter, so the page cannot be reached without signing in. The older host, https://cards-dev.twitter.com/validator, returned the same HTTP 307 to the same login page on the same day. That is the observation, and it is all this page claims about it.

What the research trail documents around it is this. X staff announced on 2022-08-02 that the preview had been taken out of the Card Validator, saying the tool remained reachable for other debugging, that the previews had not matched what the clients actually displayed, and that the best way to check is via the app itself. They told authors to paste the link into the post composer without posting, because the preview renders automatically when the URL has card metadata, and they said the legacy page would keep working for submitting new domains and for reading the fetch logs, with previews gone. The README of the official X cards sample repository still directs readers to the validator at cards-dev.twitter.com. On 2026-09-06 the legacy vendor URL for the cards markup reference returned HTTP 307 to https://docs.x.com rather than to any cards page, the page reached from there declares itself canonical at the general developer platform overview, and the current X for Websites section lists embedded Posts, timelines, the Post button, the Follow button, the oEmbed API and the publish.x.com configurator as its tools, with no Cards entry.

05Common questions about cards that do not show

Why a card does not show

Start with the message you got. X staff attribute the not whitelisted error to the tool finding no twitter:card markup in the page rather than to any approval state, and they attribute an approval message to an incorrect card type being declared in the markup. Neither one is a permission problem. They also ask whether the site is accessible by the Twitterbot/1.0 user agent, and tell authors to check robots.txt on the page domain and on any separate image domain so the crawler is allowed. Card data is cached for up to seven days before it is refreshed, so a markup fix is not necessarily visible straight away. Fetch your live URL above and the tool shows you what the relay received, which is the nearest thing to what a crawler receives that a browser can give you, then check the robots.txt of both domains with the robots.txt checker on this site using twitterbot as the user agent.

Whether og tags alone are enough

X staff give the minimum as at least a twitter:card meta tag specifying a valid card type, or suitable Open Graph fallback tags, so Open Graph alone can carry a card. Naming the card type yourself is the difference between choosing the layout and accepting whatever the fallback produces. The census shows how ordinary the fallback is. 11 of the 58 measured homepages carry a card tag with no twitter:title at all.

How to test a page that is not public yet

Paste the served HTML into the box above. The composer route X staff recommend needs a public URL, their own validator now answers a signed out GET with a redirect to a login page, and the fetch button here needs a URL the relay can reach. Paste what your server sends rather than the DOM you see in devtools after hydration, because X staff state that the crawler and validator cannot execute JavaScript and that the tags must be static. The tool flags card names it finds inside a script block for that reason.

Why the image is missing

X staff ask whether you are using an absolute and full URL, including the https protocol piece, rather than a relative one, and the README of the official X cards sample repository instructs that all paths be specified as secure with https. The Open Graph protocol also provides og:image:secure_url as the alternate URL to use when the page requires HTTPS, and it says a page that specifies og:image should also specify og:image:alt, described as a description of what is in the image rather than a caption. Load the image from the result above. If it does not load in your browser, the URL is wrong, the host refuses the request, or the file is not an image, and none of those will load for a crawler either. If it loads, the tool prints its pixel size. In the census, 6 of the 58 homepages carry a card tag with no image in either vocabulary, and only 3 ship twitter:image:alt.

What summary_large_image needs

The value does not appear in the WHATWG MetaExtensions registry entry for twitter:card, which describes the value as one of summary, photo, app or player and carries the status Proposal, a list that predates both the removal of the photo type and the arrival of summary_large_image. X uses summary_large_image on its own pages. The configuration for its developer documentation site sets it, and the served HTML of the overview page carries it on a name attribute. That configuration also ships a 1200 by 630 pixel og:image, which is the proportion the large preview box above uses. No current X page publishes a minimum or maximum size, so the tool reports the size it measured and fails nothing on it.

What this tool sends, and where

In paste mode, nothing. The text in the box is parsed by your own browser and no request goes anywhere. Pressing Fetch sends the URL you typed, and only that, to the relay, which fetches it once and returns the HTML. Loading the image sends one request from your browser to whichever host the image URL names, the same request any page that embeds that image would make. No other request is made, no cookie is set and nothing is stored.

07Where every number on this page comes from

By Michael Lip, who fetched the census, ran the recount and tried the X validator on the capture date.

Every census figure on this page is a value read by code from one file, homepage-tag-census-2026-09-06.json, published beside this page on the same origin. The instrument was one direct HTTPS GET of the homepage of each host in the 2026-08-24 robots census on this site, one request per host, redirects followed, the first 2 MB of the response kept, on the capture date 2026-09-06. A host that did not return HTTP 200 is listed in the file and excluded from every count. A card or Open Graph tag is any meta element whose property or name attribute starts with og: or twitter:, matched case insensitively in the served HTML before any script runs.

Each headline count was then cross checked by an independent recount of the same rule over the raw served HTML kept from the capture, a separate implementation in the site's fetcher code, and a figure is published only where the two implementations agree. Every figure on this page passed that recount with no spread between the two readings. A value that could not be fetched is held as null and rendered as unknown, never defaulted. The rules the tool applies are quoted from the source linked beside each finding, and the HTML Standard consulted for the meta element rules was the Living Standard published on 4 September 2026.

I run four small utility sites through Search Console and publish their impression and click counts on this site rather than a forecast. I read crawler traffic in raw server logs, where a request claiming to be Googlebot has to be checked against Google's published IP range files because the user agent string is free to forge. I fetched robots.txt from 93 well known hosts on 2026-08-24 and re-tested 76 of them five days later, and the host list measured here is that same list fetched again at its homepages. The first thing I did on 2026-09-06 was request the validator X used to run, and both of its hosts answered a plain GET with HTTP 307 to a login page, which is the observation this page starts from.

• STAFFX staff, card error thread, for the minimum markup, the Open Graph fallback, the absolute https image rule, the supported and retired card types, the head placement, the no JavaScript rule, the duplicate tag warning and the Twitterbot and robots.txt checks.
• STAFFX staff, Card Validator preview removal, for the removal of the preview, the composer route and the seven day cache.
• SPECThe Open Graph protocol, for the four required properties, og:description, og:image:alt, og:image:secure_url and the first tag wins rule.
• SPECWHATWG HTML Standard, the meta element, for what a name attribute means, the one attribute rule, and the standing of unregistered extensions.
• SPECWHATWG Wiki, MetaExtensions registry, for the twitter:card, twitter:description, twitter:image:src and twitter:creator entries and their Proposal status.
• CODEOfficial X player card sample and its README, for the name attribute, the player tags and the https instruction.
• CODEConfiguration of the X developer documentation site and the served HTML of its overview page, for summary_large_image, the 1200 by 630 image and the attribute mix on a first party page.
• DATAThe census file, every figure in section 03 and the hero, captured 2026-09-06 and published unmodified.