Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
A custom domain on its own probably won’t change anything. A domain you own and point at free hosting still gets the same browser security check. The article says this check is mandatory on all free hosting accounts and can’t be disabled. It also says premium hosting protects sites with less restrictive methods that don’t get in the way of automated tools.
The check only lets through visitors that can run JavaScript and accept cookies. The article lists “website validators and SEO checking tools” among the things that don’t work, and says blocked requests usually get a 403 or a “requires Javascript” page. Link preview scrapers are automated tools, so they would probably get that check page and not your HTML. That would explain the tags never being read, but I can’t confirm it’s what’s happening on your site.
This is the article on the security system:
Two other people recently hit the same thing with Facebook’s scraper, a 403 on free hosting. Neither topic has an answer with a workaround:
To check whether this is your problem, tell me where you’re seeing the og:url replaced. Is it in the source code you see in a normal browser, or in what a preview or debugger tool reports? If a normal browser shows your tags correctly and only the tool shows something else, it’s the security check. If your own tags are also wrong in the browser, it’s something in your page.