My honest opinion – That would take significant effort for very little in return. Or in other words, not really worth the effort.
In order for your checks to work you would have to grab a list of valid IP addresses for Meta, put them into an array and check against that array.
Something like this generally…
If User Agent = X and IP address = Y then check IP addresses in an IP address array to verify that Y = a User Agent IP address in your array.
Then one of your final allow/block PHP code conditions to handle the 403 Access Denied block.
if (!in_array($client_ip, $whitelist)) {
http_response_code(403); // Forbidden
exit('Access Denied: Your IP is blocked.');
}
Or I guess you could just check if the IP address matches the domain name that it’s supposed to match. That’s assuming that the IP address was not spoofed.
.
.