A network under constant attack
Vercel’s edge network is a frequent target for abuse. In a typical week, Vercel Firewall rejects roughly 1 billion suspicious TCP connections, and on some days the volume of malicious HTTP requests exceeds 7 billion. The platform’s built-in DDoS mitigation is designed to absorb these hits automatically, blocking thousands of threats daily without operator involvement.
The scale of this automated filtering is visible in platform-wide metrics: over a recent 30-day window, the system-level Firewall alone blocked more than 4.4 billion request attempts. That figure excludes rules each customer configures in their own Web Application Firewall instance.
The need for always-on defense was underscored by a major incident Vercel recently absorbed. Attackers launched a distributed denial-of-service campaign that peaked at 1.37 Tbps and over 300 million packets per second (Mpps). The entire event lasted roughly eight minutes, with the most intense traffic arriving in the first two. Vercel reported no downtime, no performance impact, and no need for manual intervention.
Defense in layers
Modern DDoS campaigns are no longer simple bandwidth floods. Botnets coordinate faster, and automated tooling can exploit application flaws within moments of discovery. Effective mitigation, therefore, cannot rely on a single choke point.
Vercel Firewall addresses this with a layered approach that spans the network stack. At Layer 4, it combines third-party scrubbing services with Vercel’s own infrastructure defenses. At Layer 7, proprietary protections are tailored to modern web application traffic. Because Vercel’s framework-defined infrastructure understands application semantics, the firewall can enrich requests with context that enables more precise threat classification than generic traffic inspection.
This combination of infrastructure-level filters (for threats like SYN floods and botnets) and application-level rules (for SQL injection and API abuse) operates in real time. Vercel positions this as a secure-by-default posture: customers at every tier, from hobby projects to enterprise deployments, receive automated DDoS protection out of the box. A customizable WAF layer allows teams to add their own rules on top of that baseline.
Traffic filtering without the overhead
The firewall’s global propagation and edge placement mean malicious traffic is dropped close to its source, before it can consume origin bandwidth or incur processing costs. For customers, the operational benefit is twofold: applications remain available under attack, and infrastructure bills reflect only legitimate traffic.
For teams that want to extend the default rules, Vercel provides templates such as a pre-built rule to detect common AI bots. The rule ships in Log mode so traffic is visible immediately; switching it to Deny blocks those bots outright.
