# Ensure Vercel project has rate limiting rules configured

- Source: https://support.icompaas.com/support/solutions/articles/a_1790262002325308-ensure-vercel-project-has-rate-limiting-rules-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the project has WAF custom rules with the Rate Limit action on endpoints that can be abused, such as login, sign-up, password reset, search, and API routes. Each rule should limit how many requests a single client can make in a set time window.

**Rationale**

Without rate limits, attackers can send unlimited requests to guess passwords, create fake accounts, scrape data, or run up usage costs. Rate limiting slows down these attacks by blocking or challenging clients that send too many requests in a short time, while normal users are not affected.

**Impact**

-   Slows down brute-force and scraping attacks
    
-   Helps control usage costs from abusive traffic
    
-   Limits that are too low can block real users
    

**Default Value**

By default, no rate limiting rules are configured. WAF Rate Limiting is available on all plans (1 rate limit rule on Hobby). The Fixed Window strategy is available on all plans and Token Bucket on Enterprise. Rate limiting has usage-based pricing.

**Pre-Requisites**

-   Project Administrator, team Member, or Security role
    
-   A list of endpoints to protect and their normal traffic levels
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Firewall in the sidebar.
    
5.  Open Rules and verify that the Project rules section has at least one enabled rule that uses the Rate Limit action on the sensitive endpoints.
    
6.  If none exist, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Firewall in the sidebar.
    
5.  Select Add New at the top right, choose Rate Limit, and enter a name, for example Login rate limit.
    
6.  Add an If condition that matches the endpoint (for example, Request Path, Equals, /api/login).
    
7.  Set the Then action to Rate Limit. If this is your first rate limit rule, review the Rate Limiting Pricing dialog and select Continue.
    
8.  Select Fixed Window, then set the Time Window (default 60s) and Request Limit (default 100 requests), and choose the key to count by, such as IP address.
    
9.  Leave the action as Default (429), or choose Log to monitor first, then select Save Rule.
    
10.  Select Review Changes, then select Publish, to apply the changes.
     

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Firewall in the sidebar.
    
5.  Open Rules, find the rate limit rule in the Project rules section, and disable or delete it.
    
6.  Select Review Changes, then select Publish, to apply the changes.
    

**Reference**

-   [https://vercel.com/docs/vercel-firewall/vercel-waf/rate-limiting](https://vercel.com/docs/vercel-firewall/vercel-waf/rate-limiting)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.