Firewall‑mitigated traffic is free on Vercel
By Steven Van ·
Requests and bandwidth that Vercel WAF denies, challenges, or rate-limits no longer count toward CDN billing, with no setup needed.
Vercel no longer charges for traffic that its firewall blocks. Under the updated policy, any request denied, challenged, or rate-limited by Vercel WAF is now exempt from CDN Requests and Fast Data Transfer billing.
DDoS mitigation has always been free and unlimited on Vercel. This extends the waiver to WAF, which handles bad traffic that isn't DDoS: custom rules, managed rulesets, IP blocking, and rate limiting. In practice, that means a scraper hitting product pages, a credential-stuffing botnet targeting a login route, or a bot abusing an expensive endpoint no longer adds to the bill once WAF stops it. The waiver applies automatically to every project using Vercel Firewall, with no configuration required.