Blocking Bad Traffic Before It Reaches Your App

Unwanted traffic doesn't just waste resources—it can also reach into your wallet. Platforms like Vercel offer multiple layers of defense: configurable Firewall rules, challenge mechanisms for suspicious visitors, usage alerts with hard spend limits, and code-level changes that reduce how much traffic your functions actually consume.

If you're on the free tier, unexpected spikes won't result in charges—your app is automatically paused once included usage is exhausted. Paid projects need a bit more deliberate configuration.

Custom Firewall Rules

Vercel's Firewall lets you create custom rules to log, block, or challenge traffic on all plans at no additional cost. Rules can target a wide range of fields—15+—including request path, user agent, IP address, JA4 fingerprint, geolocation, HTTP headers, and target path.

IP-Based Blocking

If you spot strange traffic coming from a single IP address, you can create a custom rule that denies all requests from that address.

JA4 Fingerprint Filtering

Sometimes suspicious traffic comes from multiple IPs, making it harder to pin down. In that case, filtering your Firewall logs by JA4 fingerprint can be more effective. JA4 produces a unique fingerprint of the TLS connection itself, which is much harder to spoof than a user agent or geolocation.

By matching on the fingerprint rather than the IP, you have a higher chance of catching and blocking bad actors, even as they rotate through different addresses. This advanced fingerprinting is available on all plans for free.

Attack Challenge Mode

When you receive a usage notification indicating your app is seeing more traffic than usual, it may not be immediately clear what's wrong. Rather than guess, you can enable Attack Challenge Mode on the Firewall.

This temporarily serves a challenge screen to every visitor. Real users pass a lightweight browser challenge in the background and continue into the app; automated malicious traffic typically fails the challenge and never reaches your application. You can also configure custom rules to challenge traffic at a more granular level.

Usage Visibility and Spend Controls

Serverless doesn't have to mean unlimited usage. If you want to avoid a surprise at the end of the month, you can define a spend limit. Vercel will alert you as you approach it, or you can configure it to automatically pause your app once the limit is reached.

Acting on traffic patterns requires real-time visibility. The usage dashboard gives you an at-a-glance view of your traffic, and the Monitoring query engine lets you dig deeper into usage patterns when something looks off.

Code-Level Usage Optimizations

Beyond blocking, you can reduce your exposure by making your application more efficient. The following areas are the ones Vercel customers most commonly optimize.

Adopt Fluid Compute

Enabling Fluid compute is strongly recommended—it's a more cost-effective model for Vercel Functions. For applications with many concurrent requests, this can save up to 85% of function usage.

Use Transformation-Based Image Optimization

On-demand image optimization is supported for frameworks such as Next.js, SvelteKit, Nuxt, Astro, and Gatsby. When enabled, the value you pass to the src attribute of an image produces multiple optimized versions based on the visitor's viewport and device.

Vercel previously billed Image Optimization based on unique source images. That has changed: you're now billed on the number of transformations, at a reduced price. If your images are already compressed before upload, you can skip the service entirely by setting the unoptimized prop in frameworks like Next.js.

Move Large Media to Blob Storage

If your usage investigation shows that large images or videos are driving Fast Data Transfer, consider moving those assets to Vercel Blob, a cost-effective object storage service built for static files. The Observability tools can help you identify exactly where those transfers originate.

Lock Down Non-Production Deployments

Every push to your repository generates a unique deployment on Vercel, which is useful for previews and instant rollbacks. However, you probably don't want all of those deployments publicly accessible.

Since November 2023, deployment protection is enabled by default for new projects. If your Vercel account predates that change, check your deployment protection settings to ensure only members of your team can access non-production deployments.

Security Layers Beyond Your Configuration

Vercel's broader infrastructure does a lot of the heavy lifting for you: on average, the platform blocks 1 billion suspicious connections per week before they ever reach your Firewall or your application.

Still, tolerance for traffic is not universal. A spike of ten thousand requests an hour might be routine for one app and catastrophic for another. Combining configurable Firewall rules, challenge modes, usage alerts, spend limits, and code optimizations gives you control over your threshold for what enters—and what gets billed.