Description

Ensure the project has the managed protections that fit its plan and needs turned on. On every plan, this means Bot Protection and AI Bots in the Bot Management section. On Enterprise, it also means the OWASP Core Ruleset in the WAF Managed Rulesets section. These rules are maintained by Vercel and protect against common attacks without writing your own rules.

Rationale

Common web attacks such as SQL injection, cross-site scripting, and automated bot traffic are well known and constantly changing. Managed rules give the project ready-made protection against these threats that Vercel keeps up to date. Without them, bots and scrapers reach the application freely and it must defend against these attacks on its own.

Impact

  • Challenges or blocks unwanted bots and AI scrapers

  • Blocks common attacks such as SQL injection and XSS (OWASP, Enterprise)

  • Some legitimate automated clients may need a bypass rule

Default Value

By default, Bot Protection is set to Off and AI Bots is set to Allow. The OWASP Core Ruleset requires the Enterprise plan (the dashboard shows an Enterprise badge and a Contact Sales button on other plans) and is billed from $0.80 per 1M requests.

Pre-Requisites

  • Project Administrator, team Member, or Security role

  • Enterprise plan for the OWASP Core Ruleset

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar and select Rules.

  5. In the Bot Management section, check that Bot Protection is not set to Off, and that AI Bots is not set to Allow unless AI crawlers are wanted.

  6. On Enterprise, scroll to the WAF Managed Rulesets section and check that the OWASP Core Ruleset is enabled.

  7. The Overview page status card also shows whether Bot Protection is Active or Inactive.

  8. If the required protections are off, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar and select Rules.

  5. In the Bot Management section, change the Bot Protection dropdown from Off to an active option, such as Log to monitor first, then Challenge.

  6. Change the AI Bots dropdown from Allow to Log or Deny, as required.

  7. On Enterprise, enable the OWASP Core Ruleset in the WAF Managed Rulesets section, and use its settings (gear) icon to choose individual rules if needed. On other plans, select Contact Sales to request it.

  8. If prompted, select Review Changes and then Publish.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar and select Rules.

  5. Set Bot Protection back to Off and AI Bots back to Allow, or disable the managed ruleset.

  6. If prompted, select Review Changes and then Publish.

Reference