# Mitigating Denial of Wallet risks with Vercel By Steven Van · 2025-01-24 Vercel's guide covers rate limits, its WAF, spend caps and bot protection as ways to stop attackers from running up a cloud bill. Vercel has published a guide to Denial of Wallet (DoW) attacks and the [Vercel]() controls it points to for limiting them. The [post]() says that unlike attacks aimed at code or infrastructure vulnerabilities, DoW attacks aim to drain a service's operational budget. The attacker sends illegitimate requests that stay under rate-limit thresholds, spread across multiple IP addresses and slowed to look like normal traffic. That makes auto-scaling resources grow and the bill rise, with nothing gained in return. The post lists four layers of defence: - **Rate limiting:** limits on incoming requests that can be adjusted without redeploying. - **Web Application Firewall (WAF):** blocks common attacks such as SQL injection and XSS, and uses challenge-response checks on suspicious activity. Ready-made firewall templates are available. - **Spend controls and monitoring:** real-time usage monitoring, budget alerts and spend limits that cap costs. - **Bot protection:** behavioural analysis, challenge-based verification such as CAPTCHAs or browser JavaScript challenges, and adaptive filtering of bots that mimic real users. Vercel also says it is building further controls and anomaly detection for these threats. [![]()]() ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() [Original source]() [Read Mitigating Denial of Wallet risks with Vercel on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-mitigating-denial-of-wallet-risks-with-vercel