--- title: Security description: Secure your applications with Vercel's Firewall, Bot Management, deployment protection, and more. url: "https://vercel.com/kb/security" published: 2025-11-03 last_updated: 2025-11-26 install_vercel_plugin: npx plugins add vercel/vercel-plugin --- # Security Secure your applications with Vercel's Firewall, Bot Management, deployment protection, and more. ## Compliance - [Supporting Compliance with Vercel WAF](/kb/guide/supporting-compliance-with-vercel-waf): Vercel Firewall provides edge-based traffic filtering and monitoring to help teams meet compliance requirements in security and regulatory frameworks, including PCI DSS, ISO 27001, SOC 2, and HIPAA. - [How to conduct PCI scans on Vercel: A complete guide to IP safelisting](/kb/guide/how-to-conduct-pci-scans-on-vercel-guide): Scan and verify your Vercel deployments for secure, PCI-compliant payment processing. - [How to build and maintain HIPAA-compliant applications on Vercel](/kb/guide/hipaa-compliance-guide-vercel): Deploy HIPAA-compliant healthcare apps on Vercel with built-in security, BAAs, and scalable serverless infrastructure. ## Abuse Prevention and Rate Limiting - [Penetration testing on Vercel](/kb/guide/penetration-testing-on-vercel): Learn how to perform pentesting on Vercel. - [Add Rate Limiting with Vercel](/kb/guide/add-rate-limiting-vercel): Learn how to implement rate limiting with Vercel ## All Security guides - [How to add per-request CSP nonces to CDN-cached HTML on Vercel](/kb/guide/csp-nonces-with-cdn-cache): Use Routing Middleware and a self-fetch to add a fresh CSP nonce to cached HTML without rendering the page again on every request. - [Run recurring security reviews with deepsec on Vercel](/kb/guide/deepsec-reviews-on-vercel): Learn how to run periodic security scans on your code with deepsec. Set up deepsec to review GitHub repositories and deliver findings to GitHub and Slack using Vercel Connect, Workflows, Sandbox, and AI Gateway. - [How to build a honeypot with Vercel Web Application Firewall](/kb/guide/how-to-build-a-honeypot-with-vercel-web-application-firewall): Learn how to build a honeypot with Vercel Web Application Firewall (WAF) that catches bots ignoring your robots.txt. Capture offending IPs and block them automatically with Vercel WAF Custom Rules and Persistent Actions. - [How do I add password protection to my Vercel deployment?](/kb/guide/how-do-i-add-password-protection-to-my-vercel-deployment): Enable Password Protection on a Vercel deployment, configure automation and CORS bypasses, and verify the gate before your next CI run. - [How to prepare your storefront for Black Friday traffic](/kb/guide/black-friday-preparation): A practical checklist for keeping your storefront fast and your checkout path healthy through Black Friday and Cyber Monday traffic, from load testing to instant rollback. - [How to protect your eve agent from prompt injection with Arcjet](/kb/guide/eve-agent-prompt-injection): Detect and block prompt injection in your eve agent with Arcjet Guards. Screen tool results and incoming Slack messages before they reach your AI model. - [Vercel BotID vs Cloudflare Turnstile](/kb/guide/vercel-botid-vs-cloudflare-turnstile): Compare Vercel BotID and Cloudflare Turnstile for bot protection, including detection model, hosting requirements, checkBotId() vs Siteverify, framework support, and pricing. - [Vercel WAF vs Cloudflare WAF](/kb/guide/vercel-waf-vs-cloudflare-waf): A detailed guide to Vercel WAF vs Cloudflare WAF: framework-aware rules, sub-300ms propagation, BotID bot detection, OWASP paranoia levels, leaked credential lookup, and when to choose each product for your web application. - [How to test a Slack bot with your Vercel preview deployment](/kb/guide/test-slack-bot-with-vercel-preview-deployment): Learn how to build and test a Slack bot using Vercel preview deployments. This guide covers setting up your Slack app, configuring webhook URLs, and bypassing deployment protection using the x-vercel-protection-bypass query parameter. - [The complete guide to authentication on Vercel](/kb/guide/complete-guide-authentication-vercel): Learn how to implement authentication in your Vercel applications. Covers NextAuth/Auth.js setup, environment variable configuration, OAuth2 for enterprise integrations, securing Server Actions, and troubleshooting common deployment issues. - [How to Utilize Vercel’s Bot Management Features](/kb/guide/how-to-utilize-vercels-bot-management-features): A practical, step-by-step guide to identifying unwanted automated traffic and securing your Vercel apps with Bot Protection Managed Rules, AI Bots Managed Rules, BotID, and custom WAF rules. Learn how to enable, monitor, and tune protections to block bad bots, preserve performance for real users, and safely allow good crawlers. - [How to Effectively Load Test Your Vercel Application](/kb/guide/how-to-effectively-load-test-your-vercel-application): Learn how to safely load test your Next.js app on Vercel. This guide covers realistic, policy-compliant testing of routes, caching, middleware, and databases to uncover performance issues without impacting Vercel’s infrastructure. - [Deploying and testing BotID](/kb/guide/deploying-and-testing-botid): This guide gives an overview on Vercel BotID and how to deploy and test it in production - [How can I allowlist IP addresses for a deployment?](/kb/guide/how-to-allowlist-deployment-ip-address): Vercel deployments use dynamic outbound IPs by default. Learn how to allowlist IP addresses for a deployment with Static IPs or Secure Compute. - [Supporting Compliance with Vercel WAF](/kb/guide/supporting-compliance-with-vercel-waf): Vercel Firewall provides edge-based traffic filtering and monitoring to help teams meet compliance requirements in security and regulatory frameworks, including PCI DSS, ISO 27001, SOC 2, and HIPAA. - [Troubleshooting request ECONNRESET errors](/kb/guide/troubleshooting-request-econnreset-errors): Understand what ECONNRESET means in Vercel runtime logs, why it happens when calling external APIs, how to diagnose it, and when to contact Vercel Support. - [How to conduct PCI scans on Vercel: A complete guide to IP safelisting](/kb/guide/how-to-conduct-pci-scans-on-vercel-guide): Scan and verify your Vercel deployments for secure, PCI-compliant payment processing. - [How to build and maintain HIPAA-compliant applications on Vercel](/kb/guide/hipaa-compliance-guide-vercel): Deploy HIPAA-compliant healthcare apps on Vercel with built-in security, BAAs, and scalable serverless infrastructure. - [How to protect your AI app from bots](/kb/guide/how-to-protect-your-ai-app-from-bots): Learn how to protect your AI app from bots, scrapers, and abuse using Firewall, BotID, and more. - [How to block bots from OpenAI GPTBot](/kb/guide/how-to-block-bots-openai-gptbot): Learn how to use the Vercel WAF to block, rate limit, or challenge traffic from OpenAI GPTBot. - [How can I use geolocation IP headers?](/kb/guide/geo-ip-headers-geolocation-vercel-functions): Learn how to read geolocation headers on Vercel with Next.js or any frontend framework. - [Securing your AI applications with Rate Limiting](/kb/guide/securing-ai-app-rate-limiting): Learn how to secure your AI applications with rate limiting using Vercel WAF and Vercel AI SDK - [Add Rate Limiting with Vercel](/kb/guide/add-rate-limiting-vercel): Learn how to implement rate limiting with Vercel - [Can I get a fixed IP address for my Vercel deployments?](/kb/guide/can-i-get-a-fixed-ip-address): Vercel deployments use dynamic IPs by default. Learn how Static IPs, Secure Compute, and AWS PrivateLink give you a fixed IP address for allowlisting. - [Block PHP requests](/kb/guide/block-php-requests): Learn how to block traffic looking for .php vulnerabilies. - [Blocking traffic from a specific IP address.](/kb/guide/traffic-spikes): Learn how to block traffic from a specific IP address. - [Firewall Terraform Configuration](/kb/guide/firewall-terraform-configuration): Learn how to create scalable firewall configurations with Terraform - [Penetration testing on Vercel](/kb/guide/penetration-testing-on-vercel): Learn how to perform pentesting on Vercel. ## Explore other topics in the Vercel Knowledge Base - [Vercel Sandbox](/kb/vercel-sandbox): The compute primitive designed to safely run untrusted or user-generated code on Vercel. - [Infrastructure and Compute](/kb/infrastructure-and-compute): Scale and deliver applications efficiently across regions using Vercel's Fluid Compute and CDN. - [Migrations](/kb/migrations): Learn how to migrate your application or agent to Vercel's agentic infrastructure. - [Backends](/kb/backends): Backends on Vercel run on Fluid compute with Active CPU pricing, plus Instant Rollback, the Vercel Firewall, protected previews, and rolling releases.