Description

Ensure each production project has at least one active Vercel WAF custom rule that matches its security needs, for example blocking known bad paths or user agents, challenging suspicious traffic, or restricting access to admin routes. Rules should be tested in Log mode before they are set to block.

Rationale

Vercel automatically blocks network-level DDoS attacks, but it does not know which traffic is harmful to your specific application. Custom rules let you block or challenge unwanted traffic, such as vulnerability scanners, bad bots, or access to sensitive paths, before it reaches your code. Without them, all of this traffic reaches the application unfiltered.

Impact

  • Filters unwanted traffic before it reaches the app

  • Protects sensitive paths and endpoints

  • Badly written rules can block real users, so start in Log mode

Default Value

By default, no custom rules are configured. Custom rules are available on all plans: up to 3 on Hobby, 40 on Pro, and 1000 on Enterprise.

Pre-Requisites

  • Project Administrator, team Member, or Security role

  • An understanding of the project's normal traffic

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar.

  5. On the Overview page, check the Custom Rules count in the status card. Then open Rules and confirm that the Project rules section lists at least one enabled rule (it shows No Custom Rules Yet when there are none).

  6. If none are active, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar.

  5. Open Rules in the Firewall sidebar and select + Add Rule in the Project rules section (or use Add New > Rule at the top right). Enter a name for the rule.

  6. Add the If conditions for the traffic you want to match.

  7. Set the Then action to Log, and select Save Rule.

  8. Select Review Changes, then select Publish, to apply the changes.

  9. After checking the logged traffic, change the action to Deny or Challenge, save, and publish again.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar.

  5. Open Rules, find the rule in the Project rules section, and disable or delete it.

  6. Select Review Changes, then select Publish, to apply the changes.

Reference