Bot Protection is now in public beta
By Steven Van ·
The ruleset is off by default on every Vercel plan and can log bot traffic or challenge it, with verified bots excluded.
Vercel's Web Application Firewall has a new Bot Protection managed ruleset, now in public beta on all plans. It targets automated traffic from non-browser sources, and the docs list it alongside the OWASP core ruleset and the AI Bots ruleset.
The ruleset has two actions:
- Log records identified bot traffic in the Firewall tab without blocking requests.
- Challenge serves a JavaScript challenge to traffic unlikely to be a browser. Verified bots are excluded automatically.
The ruleset is off by default. To turn it on, open the project's Firewall tab, go to Rules, and pick Log or Challenge under Bot Management. Then select Review Changes and Publish to apply it to the production deployment. Vercel recommends starting with Log to watch traffic before serving challenges.
Legitimate automated traffic that isn't covered by Verified Bots can be let through with a custom WAF rule using the bypass action, for example by matching a custom user agent. Vercel says Bot Protection adds a layer on top of its existing mitigations for DDoS, low quality and spoofed traffic. It covers automated traffic that isn't clearly malicious. During the beta, Vercel is collecting feedback in a thread on the Vercel Community, and it renamed the ruleset from Bot Filter to Bot Protection.