News
Open Graph vs Twitter Cards for Public Sites
November 13, 2024
Open Graph vs Twitter Cards for public sites is a preview-vocabulary decision: Open Graph (og:title, og:description, og:image, og:url) is the common unfurl format, while Twitter/X Cards add twitter:card and related names that many platforms now ignore in favor of OG. Ship accurate OG on public articles. Neither set is a security header, and RoastMyOpsec does not score missing OG or twitter: tags as a standalone F.
The practical difference
Facebook’s Open Graph protocol defined the og:* meta properties most link unfurlers still read. Twitter Cards were a parallel set; X’s developer docs still describe summary and summary_large_image cards, but a complete OG block covers most modern unfurls. Duplicate titles that disagree with the visible H1 are a brand miss, not a CVE.
The OPSEC angle is oversharing in the preview: draft titles, internal product names, author personal emails, or images that include badges and whiteboard photos. og:image is a public file. Do not point it at an authenticated CDN path that only works with a cookie.
Trackers in the same <head> are a different problem. OG tags do not load a pixel by themselves. Third-party share buttons do.
How to choose based on what you shipped
Put OG on every indexable article and the homepage. Add twitter:card only if you still see X unfurls that ignore OG. Keep images on the same public origin, HTTPS, and boring. Skip tags on pages you noindex if you do not want them unfurled from a pasted URL — or accept that the HTML is still public.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| Open Graph | You want a default unfurl across messengers and social | og:image leaking drafts or internal shots | Ship this first |
| Twitter/X Cards | You still need twitter:card extras X does not infer | Duplicating OG with conflicting copy | Optional overlay, not a second site |
| No preview tags | A tiny site where the title element is enough | Ugly unfurls, not a security hole | Not a roast F |
| Share widgets | You actually want third-party buttons | Script blast radius and cookies | Different decision than meta tags |
When Twitter Cards still win
Twitter Cards still win when you need a card type or account attribution X will not infer from OG. Open Graph still wins as the one vocabulary to maintain. Missing both is a preview-quality issue, not a headers F.
Common mistakes
The first mistake is pointing og:image at a cookie-gated asset that unfurlers fetch without the session.
The second mistake is putting embargo titles in OG while the visible page is still a teaser.
The third mistake is treating missing twitter:card as a security finding.
What a URL roast can prove
The free RoastMyOpsec audit does not score Open Graph, Twitter Cards, JSON-LD, RSS, or hreflang. It does score browser security headers, TLS, cookie flags, exposed paths like .git/HEAD and .env, package.json signatures, and secret-shaped JavaScript. Unfurl tags are public marketing; keep secrets out of them and confirm previews in each platform’s debugger.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do I need both OG and Twitter Cards?
- Usually OG is enough. Add twitter:card when you still see X-specific gaps. Do not maintain two conflicting stories.
- Are OG tags security headers?
- No. They are HTML metadata for previews. CSP and HSTS are the browser guardrails.
- Does RoastMyOpsec fail missing og:image?
- No. Social preview tags are not standalone Fs on the free roast.