# Ensure Vercel project has custom firewall rules configured

- Source: https://support.icompaas.com/support/solutions/articles/a_1790262001424744-ensure-vercel-project-has-custom-firewall-rules-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each production project has at least one active Vercel WAF custom rule that matches its security needs, for example blocking known bad paths or user agents, challenging suspicious traffic, or restricting access to admin routes. Rules should be tested in Log mode before they are set to block.

**Rationale**

Vercel automatically blocks network-level DDoS attacks, but it does not know which traffic is harmful to your specific application. Custom rules let you block or challenge unwanted traffic, such as vulnerability scanners, bad bots, or access to sensitive paths, before it reaches your code. Without them, all of this traffic reaches the application unfiltered.

**Impact**

-   Filters unwanted traffic before it reaches the app
    
-   Protects sensitive paths and endpoints
    
-   Badly written rules can block real users, so start in Log mode
    

**Default Value**

By default, no custom rules are configured. Custom rules are available on all plans: up to 3 on Hobby, 40 on Pro, and 1000 on Enterprise.

**Pre-Requisites**

-   Project Administrator, team Member, or Security role
    
-   An understanding of the project's normal traffic
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Firewall in the sidebar.
    
5.  On the Overview page, check the Custom Rules count in the status card. Then open Rules and confirm that the Project rules section lists at least one enabled rule (it shows No Custom Rules Yet when there are none).
    
6.  If none are active, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Firewall in the sidebar.
    
5.  Open Rules in the Firewall sidebar and select + Add Rule in the Project rules section (or use Add New > Rule at the top right). Enter a name for the rule.
    
6.  Add the If conditions for the traffic you want to match.
    
7.  Set the Then action to Log, and select Save Rule.
    
8.  Select Review Changes, then select Publish, to apply the changes.
    
9.  After checking the logged traffic, change the action to Deny or Challenge, save, and publish again.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Firewall in the sidebar.
    
5.  Open Rules, find the rule in the Project rules section, and disable or delete it.
    
6.  Select Review Changes, then select Publish, to apply the changes.
    

**Reference**

-   [https://vercel.com/docs/vercel-waf/custom-rules](https://vercel.com/docs/vercel-waf/custom-rules)
    
-   [https://vercel.com/docs/vercel-waf](https://vercel.com/docs/vercel-waf)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.