# Web Application Firewall control now available with vercel.json

By Steven Van · 2025-07-09

Vercel WAF rules can now be declared as JSON in vercel.json, with expanded header, path, and numeric matching options.

You can now write [Vercel](<https://creatorstoolbox.com/tools/vercel>) Web Application Firewall rules directly in vercel.json, in addition to the dashboard, API, and Terraform. Rules live under the routes property, where a has or missing condition can trigger a mitigate action of either **challenge** or **deny**; the log, bypass, and redirect actions available in the dashboard aren't supported in this format.

Vercel also expanded the has and missing matchers to support more conditions across headers, rewrites, redirects, and routes, including string equality and inequality, regular expressions, prefixes and suffixes, inclusion and exclusion from string arrays, and numeric comparisons. Because the rules are declarative JSON, Vercel says both developers and code-generating agent prompts can author and inject new rules into a project's [vercel.json](<https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules#configuration-in-vercel.json>) file.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules#configuration-in-vercel.json>)

[Read Web Application Firewall control now available with vercel.json on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-web-application-firewall-control-now-available-with-vercel-json>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-web-application-firewall-control-now-available-with-vercel-json