Layered Defenses Before a Request Reaches Your App

Vercel blocks over one billion malicious connections weekly through its Firewall, stopping threats before they can consume application resources or inflate costs. Protection is woven into the request lifecycle from the moment traffic hits Vercel's globally distributed Points of Presence (PoPs), with multiple security layers working in sequence: the platform-wide Vercel Firewall, Deployment Protection, and the customizable Web Application Firewall (WAF).

The Platform-Wide Firewall: Automatic First Response

The Vercel Firewall operates by default for all users, inspecting every incoming request at the PoP level. It employs a multi-layered defense strategy:

  • Layer 3 (network): Detects and blocks large-scale DDoS or SYN flood attacks
  • Layer 4 (transport): Prevents malicious traffic such as UDP floods from entering your infrastructure
  • Layer 7 (application): Mitigates targeted attacks, including HTTP floods and Slowloris attempts

Because this system is fully managed by Vercel, it requires no configuration and is free on all plans. Attacks are mitigated close to their source, which minimizes impact on application resources and avoids unnecessary usage costs. The Firewall also enforces IP Blocks and WAF persistent actions at this stage—both operate without counting against usage metrics. Recent infrastructure attacks, including a DDoS that peaked at 1.37 Tbps, were mitigated automatically without downtime or manual intervention.

The Vercel Firewall’s initial stages block malicious traffic using system-wide protections, preset IP rules, and persistent actions to stop repeat offenders—ensuring your resources stay protected without incurring costs. The Vercel Firewall’s initial stages block malicious traffic using system-wide protections, preset IP rules, and persistent actions to stop repeat offenders—ensuring your resources stay protected without incurring costs. The Vercel Firewall’s initial stages block malicious traffic using system-wide protections, preset IP rules, and persistent actions to stop repeat offenders—ensuring your resources stay protected without incurring costs. The Vercel Firewall’s initial stages block malicious traffic using system-wide protections, preset IP rules, and persistent actions to stop repeat offenders—ensuring your resources stay protected without incurring costs.

Deployment Protection: Project-Level Access Control

After the platform-wide Firewall clears a request, Deployment Protection evaluates it based on deployment-specific access rules. Since every commit automatically provisions infrastructure across preview, staging, and production environments, this layer lets you control who can reach those environments: Vercel account authentication, password protection, or trusted IP ranges.

Deployment Protection safeguards your preview and production URLs with Vercel Authentication, password security, and trusted IP controls. Deployment Protection safeguards your preview and production URLs with Vercel Authentication, password security, and trusted IP controls. Deployment Protection safeguards your preview and production URLs with Vercel Authentication, password security, and trusted IP controls. Deployment Protection safeguards your preview and production URLs with Vercel Authentication, password security, and trusted IP controls.

The WAF: Tailored Rules and Defense-in-Depth

During the 2024 Black Friday–Cyber Monday weekend, Vercel processed over 86 billion requests and blocked over 6 billion threats—roughly 8% of inbound traffic. System defenses handled most of those blocks, while customer-defined WAF rules managed the rest. This illustrates the division of responsibility: platform-wide protections catch global threats, but applications often need security measures tailored to their specific traffic patterns.

The Vercel WAF provides tooling for that customization:

  • Attack Challenge Mode: Presents a "Security Checkpoint" page to verify a user's browser before granting access; subsequent requests bypass the checkpoint
  • Custom rules engine: Combines parameters and actions to define precisely which traffic to allow or block

The rules engine supports over 15 parameters, including IP addresses, geolocation, user agents, and headers. Actions range from logging to challenging or blocking requests. Example use cases include:

  • Blocking unwanted IP ranges targeting critical endpoints
  • Rate-limiting high-frequency requests by region or device
  • Applying rules to specific paths with framework-aware targeting
  • Using log rules to test traffic behavior before enforcing actions

Rules execute in the order you define, giving you control over priority. Configurations can be managed programmatically via the Vercel Firewall API or Terraform Provider to stay in sync with existing workflows. WAF rules with persistent actions are evaluated earlier in the request lifecycle to block repeat offenders at the edge, preventing further processing and avoiding usage costs.

WAF rules are processed in order, giving them hierarchy—for example, if a BYPASS rule precedes a DENY, the request is allowed through unless the BYPASS condition isn’t met. WAF rules are processed in order, giving them hierarchy—for example, if a BYPASS rule precedes a DENY, the request is allowed through unless the BYPASS condition isn’t met. WAF rules are processed in order, giving them hierarchy—for example, if a BYPASS rule precedes a DENY, the request is allowed through unless the BYPASS condition isn’t met. WAF rules are processed in order, giving them hierarchy—for example, if a BYPASS rule precedes a DENY, the request is allowed through unless the BYPASS condition isn’t met.

After custom rules pass, managed rulesets such as the OWASP Core Ruleset can be activated to protect against common vulnerabilities including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats.

Requests pass through layered protections—system rules, custom logic, and managed rulesets—before reaching your app. WAF evaluations with persistent actions are shifted earlier to block repeat offenders and reduce resource usage. Requests pass through layered protections—system rules, custom logic, and managed rulesets—before reaching your app. WAF evaluations with persistent actions are shifted earlier to block repeat offenders and reduce resource usage. Requests pass through layered protections—system rules, custom logic, and managed rulesets—before reaching your app. WAF evaluations with persistent actions are shifted earlier to block repeat offenders and reduce resource usage. Requests pass through layered protections—system rules, custom logic, and managed rulesets—before reaching your app. WAF evaluations with persistent actions are shifted earlier to block repeat offenders and reduce resource usage.

A Security-First Architecture

These layers—the platform-wide Firewall, Deployment Protection, and WAF—form a defense-in-depth strategy that is proactive by default. System-level protections, preset IP rules, and persistent actions work together to ensure that only legitimate traffic reaches your application, keeping resources secure and costs predictable. Vercel continues to invest in WAF technologies and edge infrastructure as part of its commitment to a web that is secure by default.