# Ensure Vercel project has the Web Application Firewall enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790262002744279-ensure-vercel-project-has-the-web-application-firewall-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Vercel Web Application Firewall (WAF) is enabled for the project, so that its IP blocking rules, custom rules, and managed rulesets are applied to incoming traffic. The firewall should not be turned off, even temporarily, without a documented reason.

**Rationale**

If the WAF is disabled, none of the project's IP blocks, custom rules, rate limits, or managed rulesets are enforced, even if they are configured. The application is then left with only Vercel's automatic DDoS protection. Keeping the WAF enabled makes sure every configured protection actually takes effect.

**Impact**

-   All configured firewall rules are enforced
    
-   Removes a gap where rules exist but are not applied
    
-   The WAF must stay enabled for any rule to work
    

**Default Value**

The Vercel WAF is available on all plans and applies to a project once rules are configured. It can be turned off through the dashboard or the API.

**Pre-Requisites**

-   Project Administrator, team Member, or Security role
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Firewall in the sidebar and check that the status card on the Overview page shows Firewall is active.
    
5.  Alternatively, run vercel firewall overview in the linked project folder, or read the firewall configuration through the Vercel API and confirm that firewallEnabled is true.
    
6.  If the firewall is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  The dashboard does not have a switch to turn the whole firewall off, so a disabled firewall is usually caused by the API. Use the Vercel API PATCH /v1/security/firewall/config?projectId=<project-id> to set firewallEnabled to true.
    
5.  Confirm that the configured rules are active.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Use the Vercel API PATCH /v1/security/firewall/config?projectId=<project-id> to set firewallEnabled to false.
    

**Reference**

-   [https://vercel.com/docs/vercel-firewall](https://vercel.com/docs/vercel-firewall)
    
-   [https://vercel.com/docs/cli/firewall](https://vercel.com/docs/cli/firewall)
    
-   [https://vercel.com/docs/rest-api/security/update-firewall-configuration](https://vercel.com/docs/rest-api/security/update-firewall-configuration)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.