A single-click bot gate for every Vercel project

The Vercel Web Application Firewall (WAF) already inspects billions of daily requests, blocking cross-site scripting, traversal attacks, application-layer DDoS, and obviously malicious bot traffic. Today, Vercel is adding a sharper instrument to that stack: a new managed ruleset called Bot Protection, available free to all users on every plan.

Bot Protection gives developers a one-click toggle to filter incoming traffic by whether it originates from a real browser client or from non-browser automation. When the ruleset is enabled, browser-based traffic and a maintained list of verified bots pass through, while requests from tools such as curl or unknown scrapers are issued a challenge.

Why another bot shield?

Automation is a structural feature of the web, but malicious bots are not a niche concern—estimates put them at nearly one-third of all internet traffic. That scale demands more than a single defensive posture, because no one detection method is sufficient.

Vercel’s existing protections remain in place:

  • Platform-wide DDoS mitigations stop botnets behind HTTP floods and malformed requests.
  • Firewall templates let users deploy rules from open source blocklists and common AI scraper lists.
  • Attack Challenge Mode can be switched on during highly-sophisticated or targeted attacks.

What those tools lacked, Vercel argues, is an always-on, always-adapting layer that targets ordinary unwanted automation without requiring constant rule authoring. Bot Protection is built to fill that gap.

How the managed ruleset makes its calls

Bot Protection relies on heuristics rather than a static blocklist. It classifies traffic as browser-based (human) or non-browser (likely bot) with zero configuration. The key decisions are:

  • Requests from real browsers and Vercel-verified bots are allowed, including internal sources like project cron jobs and API calls from your own functions.
  • Requests from non-browser clients, including curl and unwanted scrapers, can be issued a challenge.

Because Bot Protection is a managed ruleset inside the WAF, Vercel maintains the verified bots list itself, relieving users of upkeep. The list is also documented publicly at bots.fyi, and SaaS providers can request inclusion of their own bots through that site.

Where it fits, and where it doesn’t

Bot Protection is suitable for sites where most traffic should come from humans plus known useful bots, such as AI or SEO crawlers. Continuously challenging non-browser traffic reduces wasted resource usage from unauthorized automation and keeps the experience clean for real users.

For its own recommendation, Vercel suggests first running the ruleset in Log-Only Mode to observe what would have been challenged. If you operate legitimate automated clients that are not on the verified list, you can add custom WAF rules with a bypass action to keep that traffic flowing.

The boundary matters: Bot Protection is not designed to defeat sophisticated bots that mimic human and browser behavior. To block all automation unconditionally, Attack Challenge Mode remains the appropriate tool.

What’s next for bot management

Vercel describes bot management as a growing priority: the volume and sophistication of automated traffic is changing how applications are built and secured. On the roadmap are deeper observability into bot traffic, more granular control over verified and AI bots, a Bot Protection SDK, and runtime bot protection capabilities. Enterprise customers will also gain access to underlying detection signals as configurable inputs in the Firewall, enabling more advanced rules for automated traffic.

Feedback is open during the public beta through a dedicated thread on the Vercel Community. To get started, enable Bot Protection from your project’s Firewall Configure dashboard. If you don’t yet have a clear picture of your traffic patterns, begin in Log-Only Mode and refine from there before turning on active enforcement. Additional detail is available in the Vercel changelog and Bot Protection documentation. Notably, the ruleset was renamed from “Bot Filter” to “Bot Protection” during the beta period.