My preview shows no image. What is wrong?
Check three things in this order. First, is the og:image value an absolute URL beginning with https, because a relative path never works. Second, can the image be fetched by a stranger with no cookies, since a staging site behind basic auth or an image directory disallowed in robots.txt will fail silently. Third, are the tags present in the HTML the server returns, rather than added later by JavaScript, because scrapers do not execute scripts. One of those three accounts for nearly every blank preview.
I updated my image but the old one still appears. Why?
Because the platform cached it when the URL was first shared, and it has no reason to check again. Facebook, LinkedIn, and Slack all keep a scraped copy for a long time. Each has a debugging tool that forces a re-scrape: the Sharing Debugger for Facebook, the Post Inspector for LinkedIn. The approach that always works, and that you should prefer for anything important, is to publish the new image at a new URL, since a URL that has never been scraped cannot have a stale cache.
What size should the image be?
1200 by 630 pixels is the answer for almost every case. It matches the 1.91:1 ratio that Facebook and LinkedIn use, and Twitter's large summary card crops it acceptably. Keep the file under about 5 MB, well under in practice, and put any important text in the middle, because different platforms crop the edges differently. Anything smaller than 200 pixels on a side will be rejected outright and you will get no image at all.
Do I need Twitter card tags as well as Open Graph tags?
Only for the parts that differ. X falls back to the Open Graph tags when the Twitter-specific ones are missing, so og:title, og:description, and og:image are enough to produce a card. What you do need to state explicitly is twitter:card, because that chooses the layout, and summary_large_image is what gives you the big image rather than a small thumbnail. Adding twitter:site with your handle earns the attribution line.
Is my page data sent anywhere?
No. The tags are built in your browser from what you type. Nothing about an unreleased page title, URL, or image is transmitted or stored.