How to Utilize Vercel’s Bot Management Features

You or your security team noticed irregular traffic on your Vercel-hosted site. High request volumes from regions you don’t serve, users with outdated browsers or OS versions, or sudden spikes in authentication requests might indicate malicious or automated traffic. These patterns can inflate costs, skew analytics, or degrade performance for legitimate users.

Vercel provides built-in bot management features, including Bot Protection Managed Ruleset, AI Bots Managed Ruleset, BotID, and Custom Web Application Firewall (WAF) Rules to help mitigate these issues without blocking valid traffic. However, understanding when and how to use each feature effectively is key to maintaining both security and usability.

This guide walks through how to implement and tune these Vercel features to detect, analyze, and mitigate unwanted automated traffic to your Next.js application.

Before enabling protection, determine whether your site is truly seeing unwanted traffic.

• Sudden request spikes to login or checkout routes.
• Traffic spikes unassociated with expected high-traffic events or marketing campaigns, especially spikes that plateau for a period of time.
• High traffic from unsupported regions or data center networks, as tracked by Autonomous System Numbers (ASNs) like AWS, OVH, or DigitalOcean.
• Requests with outdated or malformed User-Agent headers.
• High 4xx or 5xx error rates from the same IP ranges.
• Suspicious referral patterns (e.g., all requests have Referer: null).

• Vercel Firewall Observability → view IP, User-Agent, and request counts.
• Vercel Observability → identify unusual traffic patterns and request metadata.
• Runtime Logs → filter for repeated hits to /api or /auth routes.
• External telemetry → correlate with Logflare, Datadog, or Sentry for patterns.

Not all bots are harmful. Some are essential to your business or product visibility.

By default, Vercel allows verified bots to access your site, even when the Bot Protection Managed Ruleset is enabled. This can be changed by using the AI Bots Managed Ruleset in deny mode.

• Review Vercel’s default allowed bot list before tightening access controls.
• If your business relies on a bot that is listed as “unverifiable”, consider adding custom WAF rules to allow it to bypass any protections in place.
  • Keep in mind that malicious users may spoof the metadata used to identify these bots, so a rate limit or other means of access control may still be necessary to ensure you do not overexpose your application to undue risk.

• Navigate to Firewall → Rules → Bot Management in your Vercel Dashboard.
• Toggle Bot Protection to one of the following modes
  • Log Mode (default for detection and visibility)
  • Challenge Mode (active blocking or Javascript browser challengeCAPTCHA)
• Publish your changes to have Bot Protection take effect

Review: Vercel Bot Management Documentation

• Navigate to Firewall → Rules → Managed Rulesets in your Vercel Dashboard.
• Toggle AI Bots to one of the following options:
  • Log - Logs AI bot traffic without challenging or blocking it
  • On - Blocks AI Bot traffic from accessing your site
• Publish your changes to have your AI Bot management ruleset change take effect

Review: AI Bot Managed Ruleset Documentation

Enabling BotID requires installing the BotID package, initializing the configuration, and deploying your project so BotID can begin inspecting requests. Once enabled, BotID automatically annotates incoming requests with bot classification data that you can read from request headers or view in the Vercel Dashboard.

For full installation, configuration, and deployment steps, see the official guides:

• Deploying and testing BotID
• BotID getting started guide

After BotID is enabled, you may integrate its request metadata into Next.js Middleware or your logging pipeline to support rate limiting, anomaly detection, fraud reduction, or traffic quality analysis.

Review: Vercel BotID Documentation

• Navigate to Firewall → Overview, Firewall → Rules → IP Blocking, or System Bypass Rules in your Vercel Dashboard.
• Create a new rule using one or more conditions (e.g., path, region, IP range, or request volume).
• Save and publish.
• Alternatively, you can also configure custom WAF rules directly in vercel.json

1
{
2
  "$schema": "<https://openapi.vercel.sh/vercel.json>",
3
  "routes": [
4
    {
5
      "src": "/(.*)",
6
      "has": [
7
        {
8
          "type": "header",
9
          "key": "x-react-router-prerender-data"
10
        }
11
      ],
12
      "mitigate": {
13
        "action": "deny"
14
      }
15
    }
16
  ]
17
}

For a more detailed walkthrough, see our guide on getting started with custom WAF rules.

Vercel provides multiple observability layers to monitor and tune protection behavior.

• Go to Firewall → Overview or Firewall → Traffic to find your project’s Firewall analytics dashboards.
• Review:
  • Overview
    • Firewall status - Displays the current status of the Firewall, Bot Protection, and total number of rules.
    • Firewall Alerts - Shows recent Firewall Alerts, their current status, and total number of involved requests.
    • Firewall events - Shows recent Firewall events, the associated rule type, action taken, and more.
    • Traffic breakdown by action - Filter the entire Firewall dashboard by all traffic, allowed, logged, challenged, denied, or rate-limited.
    • Rules - Shows configured rules sorted by total amount of relevant traffic.
    • Denied IPs - Shows the country of origin, IP address, and total number of requests in the current evaluation period.
  • Traffic
    • Traffic breakdown by action - Filter the entire Firewall dashboard by all traffic, allowed, logged, challenged, denied, or rate-limited.
    • Rules - Shows configured rules sorted by total amount of relevant traffic.
    • Other key traffic information, such as top IPs, top user agents, top request paths, and more.
• For Alerts and events, you can click on each entry to expand into a full view with additional details and a link to explore further in Query.
• If you’re using Bot Protection in Log Mode, track when and if to enable Challenge Mode based on logged traffic.
  • A request being logged doesn’t always mean it is illegitimate or malicious. Utilize Challenge Mode to enhance protection or consider gradually tightening security with targeted custom WAF rules, like rate limits and geography-based blacklists.

Review: Firewall Observability

If you have Observability Plus enabled, you can create custom queries to further evaluate Firewall data:

• Search for data by metrics like WAF Actions, Rule IDs, or BotID Deep Analysis checks.
• Open events or Alerts directly in Query to evaluate further.
• Utilize insights from Observability to determine when and how to tighten restrictions on your site.
  • Establish base lines for rate limits, regions with legitimate users, and metadata trends for friendly bot traffic.
  • When traffic or usage patterns deviate from these baselines, consider adding a new custom WAF rule to limit unwanted or malicious traffic or toggle Bot Protection into Challenge Mode.

1. Review and publish any changes to rulesets or features.
2. For BotID, make necessary updates to your code base and deploy your updated project.
3. Validate:
   • Bot Protection and BotID logs appear in Firewall Observability.
   • Legitimate user traffic remains unaffected.
   • Suspicious test requests are blocked or challenged.
4. Use tools like curl or k6 to simulate controlled traffic.
   • Verify that rate limits, geographic-based blocks, and whitelists all function as expected.

Once completed:

• Bot Protection Managed Ruleset logs and optionally challenges automated traffic.
• AI Bot Managed Ruleset logs or blocks unwanted AI Bots.
• If enabled, BotID provides visibility into threat sources and patterns.
• Custom WAF Rules enforce region, IP, and rate-based filtering.
• Your application remains performant and secure for real users while mitigating automated abuse.

• Vercel Security and Protection Overview
• Vercel Bot Protection Documentation
• Vercel BotID Documentation
• Vercel Web Application Firewall
• Vercel Firewall Concepts
• Next.js Middleware
• Vercel Analytics
• Vercel Observability and Logs
• Vercel REST API Reference

If you encounter issues not covered by this guide:

• Visit Vercel Support
• Check Vercel Community
• If you’re on a Pro or Enterprise plan, open a ticket directly in your Vercel Dashboard