Vercel expands WAF with persistent blocking, rate limits, and API-driven management

Vercel has announced three major upgrades to its Web Application Firewall (WAF), the application-layer firewall introduced at Vercel Ship alongside the platform-wide firewall. The new capabilities target repeat offenders, API traffic control, and automated security workflows. Since launch, the WAF has blocked billions of malicious requests across deployments ranging from startups to enterprise applications.

The announced features include:

  • Persistent actions: Apply rules to all matching requests for a configurable duration, blocking repeat offenders earlier in the request lifecycle.
  • Rate limiting: Set per-endpoint request limits to curb API abuse without degrading performance for legitimate users.
  • Firewall API: Manage WAF settings programmatically to automate security workflows and integrate with external tools.

Broader protection and faster rule propagation

Vercel's Challenge page, previously exclusive to the WAF, is now available across the broader Vercel Firewall. This browser verification feature strengthens automated bot management and DDoS protection platform-wide.

Rule propagation remains a core differentiator. Traditional firewalls can take up to 20 minutes to apply updates globally, leaving a window for attackers. Vercel's Edge Network propagates rules worldwide in approximately 300 milliseconds, closing that gap and ensuring security policies remain active for every request regardless of origin.

Persistent actions stop repeat offenders

Previously, the WAF evaluated each request independently, even when identical malicious traffic had just been blocked. With persistent actions, matching requests are blocked for a customizable duration after the first violation. This stops threats earlier in the request lifecycle and prevents them from consuming Edge resources.

With persistent actions enabled, edge requests are processed earlier in the lifecycle, bypassing usage metrics and WAF evaluation for known bad actors. This reduces redundant evaluations and keeps the application focused on legitimate user traffic.

General availability of rate limiting

Rate limiting is now generally available in the Vercel WAF, providing granular control over request frequency for specific endpoints. Persistent actions can be layered with rate limiting to block identified bad actors quickly and reduce resource strain.

The configuration supports both specific and broad rules. For example:

  • /api/user allows 5 requests per minute
  • /api/* allows 100 requests per minute

Requests containing /api are first evaluated against /api/user. If that limit is exceeded, the configured action—log, block, challenge, or deny—applies immediately. If it passes, the request is then checked against /api/*, with its own action triggered when that limit is exceeded. The layered approach gives precise control over individual endpoints while maintaining broader API safeguards.

Programmatic management via Firewall API

The new Firewall API enables programmatic control over WAF settings, supporting automated security workflows and third-party integrations. Teams can create or adjust rules dynamically based on real-time traffic, which is particularly valuable when running custom intelligence feeds or anomaly detection systems.

The API covers the full range of Firewall features, allowing security management even outside active monitoring windows. This is designed for teams operating mission-critical applications that require continuous protection without manual intervention.

The combination of rapid rule propagation, persistent blocking, rate limits, and API-driven control is aimed at integrating security directly into the development workflow rather than treating it as an external compliance step.