When a link is pasted into a chat or a social network, the receiving app fetches the page once and builds a card from a handful of meta tags: og:title, og:description, og:image, and for X the twitter:card type. Every mistake shows up as a broken preview: a missing image, a tiny logo stretched across the card, a title that is the site name, a description that is the cookie notice. This check fetches the page from this server, reads the tags, downloads the image and measures it, and draws the card as a first share would see it, without any script from the target page running here.
From this server: one request for the page (at most 1 MB) and one for the og:image (at most 6 MB). The preview shows a reduced copy of that image, embedded in the answer, so the browser of the visitor does not load anything from the target site. Hosts in private, loopback and link-local networks are refused. The query is protected by reCAPTCHA v3; the calling IP address and the target are stored for one hour to limit the rate.
Limits worth knowing: only tags in the served HTML count, tags inserted by JavaScript are invisible to every crawler and to this check alike; the card drawn here follows the common layout, each network crops and truncates in its own way; caches at Facebook, LinkedIn and messengers keep an older version of a page for days, so a fixed tag may show up there only after a re-scrape; and only the first og:image is measured.