Attack Challenge Mode now allows verified bots and Vercel cron jobs
By Steven Van ·
Stripe, PayPal, Googlebot and same-account cron jobs no longer need workarounds when Attack Challenge Mode is switched on.
Verified webhook providers, including Stripe and PayPal, are now allowed through Vercel's Attack Challenge Mode automatically, so payment processing keeps running while the mode is on. The change was announced on 1 April 2025.
- Well-behaved bots from major search engines, such as Googlebot, and from analytics platforms are also supported.
- Vercel Cron Jobs running in the same account are exempt from challenges. Like other trusted internal traffic, they bypass Attack Challenge Mode automatically.
Known bots are validated as authentic and cannot be spoofed to bypass the mode. To block a specific known bot, create a custom rule that matches its User Agent.
Vercel
The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.
View Vercel →