How to stop bots and DDoS traffic on Vercel

Does Vercel charge for DDoS traffic?

Vercel's platform-wide firewall includes automated DDoS and TCP flood mitigation at no cost for all customers on all plans, requiring no configuration. When traffic hits this platform-wide layer, requests blocked by the edge network do not reach your Serverless Functions, Edge Middleware, or backend systems.

More importantly, requests blocked by Vercel Attack Mode do not count toward your usage limits. All mitigations handled by Attack Mode are free and unlimited, meaning traffic blocked by it incurs zero costs.

However, if malicious requests slip past platform protections and trigger your functions, you pay standard metered rates for that execution time and bandwidth. If you want to dive deeper into how sudden usage escalates, see Why is my Vercel bill so high, and what usually causes it?.

What is Vercel Attack Challenge Mode?

Attack Mode is an on-demand security setting in the Vercel Firewall. When you enable it, every visitor must pass a managed security challenge in their browser before accessing the site.

Incoming Request
       │
       ▼
[ DDoS Mitigation ] ──── Blocked? ──> Dropped ($0)
       │
       ▼
[ WAF IP Blocking ] ──── Matched? ──> Dropped ($0)
       │
       ▼
[ WAF Custom Rules ] ─── Matched? ──> Blocked / Bypassed
       │
       ▼
[ Attack Challenge ] ─── Automated Bot? ──> Challenged / Blocked ($0)
       │
       ▼
[ Production Deployment ] (Metered execution & bandwidth)

The tool stops botnets, scrapers, and automated request floods from reaching serverless compute. It does this without taking your entire site offline for normal visitors.

Who it lets through

Attack Mode does not challenge every single incoming network packet uniformly:

• Known bots: Search engine crawlers such as Googlebot bypass the challenge automatically. Enabling Attack Mode for extended periods does not negatively impact search indexing or SEO. Webhook providers are also allowed through without a challenge.
• Internal services: Requests originating from your own Functions and Cron Jobs pass through unhindered.
• Same-account projects: Security boundaries are enforced strictly per account. Projects inside the same Vercel account can communicate with each other without challenges, but requests from external Vercel accounts are challenged.
• Web browser traffic: Browsers capable of solving challenges pass through smoothly. This includes frontend-to-API calls within the same project, such as a Next.js frontend querying a route handler in that exact deployment.

Who it blocks

Standalone APIs, external backend frameworks, and non-recognized automated systems cannot solve interactive browser challenges. As a result, those services will fail the check and get blocked.

If there are specific known bots that Attack Mode normally lets through by default, you can override that behavior by creating a Custom Rule that matches their specific User Agent string.

How to turn Attack Mode on and off

Anyone with the member role or higher can toggle the feature directly in the console.

To turn it on:

1. Select your project from the Dashboard.
2. Open Firewall in the sidebar.
3. Click Bot Management.
4. Under Attack Mode, select Enable.

To turn it off:

1. Select your project from the Dashboard.
2. Open Firewall in the sidebar.
3. Click Bot Management.
4. Under Attack Mode, select Disable.

Vercel Firewall rules and execution order

The Vercel WAF is available on all plans to users with the member, viewer, developer, or administrator roles. It layers custom controls on top of the platform-wide protections.

The engine evaluates incoming requests in a fixed sequence:

1. DDoS mitigation rules
2. WAF IP blocking rules
3. WAF custom rules
4. WAF Managed Rulesets

You can manage custom bypass rules and your broader WAF setup programmatically using the REST API, the Vercel SDK, direct endpoint calls, or Terraform. This makes it possible to script IP bans or deploy custom rulesets when a coordinated attack starts hitting specific endpoints. For more details on this threat model, read What is a denial-of-wallet attack, and how do I defend against it?.

How to pause a Vercel project when traffic spikes

If bot traffic bypasses your rules and runs up charges, your last line of defense is pausing the project. Vercel provides this through Spend Management, which tracks metered usage beyond the Pro plan monthly credit (or metered usage drawing down prepaid balances on Enterprise with Flexible Commitment).

Setting a spend amount does not halt traffic by itself. To stop incurring costs above your target, you must actively turn on the Pause Production Deployments setting.

How to set an On-Demand Budget

Users with the Owner or Billing role can configure these controls in the dashboard:

1. Open your team Settings from the sidebar.
2. Select Billing from the list.
3. Under Spend Management, toggle the switch to enabled.
4. Set the On-Demand Budget amount in USD.
5. Turn on Pause Production Deployments.

You can also configure this via the command line. In Vercel CLI version 65.11.0 and later, manage your budget with vercel billing budgets (the older vercel budgets command prints a deprecation warning).

Run this command to set a $200 budget that pauses production and posts to an external endpoint:

vercel billing budgets set --amount 200 --pause --webhook https://example.com/spend

Spend Management automatically fires web and email notifications when your team reaches 50%, 75%, and 100% of the configured spend amount, with an option for SMS alerts at 100%. Webhooks send an HTTPS POST payload containing budgetAmount, currentSpend, teamId, and thresholdPercent, which you can verify using the x-vercel-signature header (note that budgets created before September 2025 only fire webhooks at 100%).

If you need a complete walk-through of these thresholds, read How do I set a spending limit on Vercel?.

What happens when production is paused

When Spend Management pauses a project, production deployments stop serving traffic immediately, returning a 503 DEPLOYMENT_PAUSED error to all visitors. Serverless functions and edge executions stop running.

Keep these caveats in mind:

• The check delay: Vercel checks resource usage every few minutes. Because it is not instantaneous, pauses and alerts can trigger several minutes after your usage crosses the dollar threshold.
• Excluded charges: Spend Management tracks metered usage, but does not track seats, Marketplace integrations, or separate monthly add-ons. Pausing does not stop AI Gateway API key usage, v0 usage, or ongoing storage charges (such as Deployment Storage, Functions Storage in GB-months, Vercel Blob, and Vercel Container Registry).
• Unpausing is manual: If you increase your spend amount later, paused projects do not automatically resume. You must manually unpause each project one by one through the dashboard or via the REST API.
• Immediate triggers: If you accidentally set the On-Demand Budget below your current monthly spend, Spend Management triggers your configured actions (including pausing all projects) on its next check.

Tracking unexpected spend across your stack with Costbrake

If you run external databases, LLM endpoints, or background queues alongside Vercel, a bot flood on your frontend usually triggers downstream costs on those services too. Costbrake monitors 23 cloud, AI, and SaaS platforms, including AWS, Cloudflare, OpenAI, Supabase, Neon, and Vercel.

Checks run hourly on the Free plan ($0 with 2 connections), every 5 minutes on Pro ($12 a month for 10 connections), and every 2 minutes during an active spike. A spike alert triggers if an hour costs more than 3x the 7-day baseline and at least $5 above normal. Pro and Team plans also include opt-in, reversible brakes for 18 providers. For Vercel, an admin can click to trigger Attack Challenge Mode or pause a project directly from the alert. Costbrake never triggers a brake on its own; an admin must review and confirm it.

To connect your providers, you can hand off the process to your coding agent by following our agent setup guide, or connect tokens manually in the dashboard. To view all plan limits and features, check Costbrake pricing.