Create --- title: Vercel Firewall product: vercel url: /docs/vercel-f…

[zyntromedia]

…irewall canonical_url: "https://vercel.com/docs/vercel-firewall" last_updated: 2026-08-11 type: conceptual prerequisites: [] related: - /docs/vercel-firewall/ddos-mitigation - /docs/vercel-firewall/firewall-concepts - /docs/vercel-firewall/vercel-waf/ip-blocking - /docs/vercel-firewall/vercel-waf/custom-rules - /docs/vercel-firewall/vercel-waf/managed-rulesets summary: Learn how Vercel Firewall helps protect your applications and websites from malicious attacks and unauthorized access. install_vercel_plugin: npx plugins add vercel/vercel-plugin --- # Vercel Firewall The Vercel Firewall is a robust, multi-layered security system designed to protect your applications from a wide range of threats. Every incoming request goes through the following firewall layers: ## Related pages > For AI agents: Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below. - Bot Protection is now generally available - Bot Protection is now in public beta - Create custom WAF rules directly from the Vercel Firewall tab - Create Vercel Firewall rules with natural language - Improved analytics experience now available on the Vercel Firewall - Application authentication on Vercel — Secure application authentication on Vercel across layers: proxy checks, the Data Access Layer, PPR-safe rendering, and - How to prepare your storefront for Black Friday traffic — A practical checklist for keeping your storefront fast and your checkout path healthy through Black Friday and Cyber Mon - Building an AI chat app with RAG and source citations on Vercel — A production stack for AI chat with retrieval, reranking, source citations, and background ingestion on Vercel using Nex - Debug routing on Vercel — Learn how to debug how Vercel decides where to route your request - How to build and maintain HIPAA-compliant applications on Vercel — Deploy HIPAA-compliant healthcare apps on Vercel with built-in security, BAAs, and scalable serverless infrastructure. - How we run Vercel's CDN in front of Discourse - Life of a Vercel request: Securing your app's traffic with Vercel Full cross-link map for this page: /docs/vercel-firewall.graph.md - Platform-wide firewall: With DDoS mitigation, it protects against large-scale attacks such as DDoS and TCP floods and is available for free for all customers without any configuration required. - Web Application Firewall (WAF): A customizable layer for fine-tuning security measures with logic tailored to your needs and observability into your web traffic. ### Concepts Understand the fundamentals: - How Vercel protects every request. - Why DDoS needs to be mitigated. - How the firewall decides which rule to apply first. - How the firewall uses JA3 and JA4 TLS fingerprints to identify and restrict malicious traffic. ## Rule execution order The automatic rules of the platform-wide firewall and the custom rules of the WAF work together in the following execution order: 1. DDoS mitigation rules 2. WAF IP blocking rules 3. WAF custom rules 4. WAF Managed Rulesets When you have more than one custom rule, you can customize their order in the Firewall section in the sidebar of the project. ## Platform-wide firewall > 🔒 Permissions Required: DDoS Mitigation Vercel provides automated DDoS mitigation for all deployments, regardless of the plan that you are on. With this automated DDoS mitigation, we block incoming traffic if we identify abnormal or suspicious levels of incoming requests. ## Vercel WAF > 🔒 Permissions Required: Vercel WAF The Vercel WAF complements the platform-wide firewall by allowing you to define custom protection strategies using the following tools: - Custom Rules - IP Blocking - WAF Managed Rulesets - Attack Mode You can also manage bypass rules and your WAF configuration programmatically with the REST API through the Vercel SDK, direct endpoint calls, or Terraform. ## Observability You can use the following tools to monitor the internet traffic at your team or project level: - The Monitoring feature at the team level allows you to create queries to visualize the traffic across your Vercel projects. - Firewall in the Vercel dashboard sidebar on every project allows you to monitor the internet traffic to your deployments with a traffic monitoring view that includes a live traffic window. - Firewall alerts allow you to react quickly to potential security threats. - Use Log Drains to send your application logs to a Security Information and Event Management (SIEM) system. --- [View full sitemap](/docs/sitemapSkill.md

---

name: Default
about: General change (backend, frontend, knowledge, infra)
title: ""
labels: ""
assignees: ""

Summary

Type of change

• ✨ Feature (new capability)
• 🐛 Bugfix (fixes a defect)
• 🔒 Security (vulnerability / hardening)
• ⚙️ Configuration / Infra / CI
• 📚 Documentation
• 📦 Dependency
• 🚀 Release

Specialized template? If your change is primarily Security, a
Release, Configuration/Infra, Documentation, Dependency or a
Bugfix, please use the matching typed template in
.github/PULL_REQUEST_TEMPLATE/ instead — each
carries the checks the PR-quality CI expects for that type.

Scope

• Backend (backend/)
• Frontend (frontend/)
• Knowledge / docs (knowledge/, docs)
• Infra / CI (k8s/, .github/workflows/)
• Other: _____

What changed

How tested

• Lint passes (ruff / eslint)
• Tests pass (pytest / vitest)
• Manual verification

(paste test / verification output)

Checklist

• No secrets committed
• No unrelated changes bundled
• Existing files not clobbered (additive where appropriate)
• Changes are minimal and targeted