--- title: Security description: Block bots and abusive traffic, rate limit your APIs, protect deployments, and support PCI DSS, HIPAA, and SOC 2 compliance with the Vercel Firewall and BotID. url: "https://vercel.com/kb/security" published: 2025-11-03 last_updated: 2026-10-29 install_vercel_plugin: npx plugins add vercel/vercel-plugin --- # Security Block bots and abusive traffic, rate limit your APIs, protect deployments, and support PCI DSS, HIPAA, and SOC 2 compliance with the Vercel Firewall and BotID. [View security bulletins](/kb/bulletin) ## Compliance - [Supporting Compliance with Vercel WAF](/kb/guide/supporting-compliance-with-vercel-waf): Vercel Firewall provides edge-based traffic filtering and monitoring to help teams meet compliance requirements in security and regulatory frameworks, including PCI DSS, ISO 27001, SOC 2, and HIPAA. - [How to conduct PCI scans on Vercel: A complete guide to IP safelisting](/kb/guide/how-to-conduct-pci-scans-on-vercel-guide): Scan and verify your Vercel deployments for secure, PCI-compliant payment processing. - [How to build and maintain HIPAA-compliant applications on Vercel](/kb/guide/hipaa-compliance-guide-vercel): Deploy HIPAA-compliant healthcare apps on Vercel with built-in security, BAAs, and scalable serverless infrastructure. ## Abuse Prevention and Rate Limiting - [Penetration testing on Vercel](/kb/guide/penetration-testing-on-vercel): Learn how to perform pentesting on Vercel. - [Add rate limiting with Vercel](/kb/guide/add-rate-limiting-vercel): Learn how to implement rate limiting with Vercel. ## All Security guides - [How to add per-request CSP nonces to CDN-cached HTML on Vercel](/kb/guide/csp-nonces-with-cdn-cache): Use Routing Middleware and a self-fetch to add a fresh CSP nonce to cached HTML without rendering the page again on every request. - [Run recurring security reviews with deepsec on Vercel](/kb/guide/deepsec-reviews-on-vercel): Learn how to run periodic security scans on your code with deepsec. Set up deepsec to review GitHub repositories and deliver findings to GitHub and Slack using Vercel Connect, Workflows, Sandbox, and AI Gateway. - [How to build a honeypot with Vercel Web Application Firewall](/kb/guide/how-to-build-a-honeypot-with-vercel-web-application-firewall): Learn how to build a honeypot with Vercel Web Application Firewall (WAF) that catches bots ignoring your robots.txt. Capture offending IPs and block them automatically with Vercel WAF Custom Rules and Persistent Actions. - [How to prepare your storefront for Black Friday traffic](/kb/guide/black-friday-preparation): A practical checklist for keeping your storefront fast and your checkout path healthy through Black Friday and Cyber Monday traffic, from load testing to instant rollback. - [How to protect your eve agent from prompt injection with Arcjet](/kb/guide/eve-agent-prompt-injection): Detect and block prompt injection in your eve agent with Arcjet Guards. Screen tool results and incoming Slack messages before they reach your AI model. - [Vercel BotID vs Cloudflare Turnstile](/kb/guide/vercel-botid-vs-cloudflare-turnstile): Compare Vercel BotID and Cloudflare Turnstile for bot protection, including detection model, hosting requirements, checkBotId() vs Siteverify, framework support, and pricing. - [Vercel WAF vs Cloudflare WAF](/kb/guide/vercel-waf-vs-cloudflare-waf): A detailed guide to Vercel WAF vs Cloudflare WAF: framework-aware rules, sub-300ms propagation, BotID bot detection, OWASP paranoia levels, leaked credential lookup, and when to choose each product for your web application. - [How to test a Slack bot with your Vercel preview deployment](/kb/guide/test-slack-bot-with-vercel-preview-deployment): Learn how to build and test a Slack bot using Vercel preview deployments. This guide covers setting up your Slack app, configuring webhook URLs, and bypassing deployment protection using the x-vercel-protection-bypass query parameter. - [The complete guide to authentication on Vercel](/kb/guide/complete-guide-authentication-vercel): Learn how to implement authentication in your Vercel applications. Covers NextAuth/Auth.js setup, environment variable configuration, OAuth2 for enterprise integrations, securing Server Actions, and troubleshooting common deployment issues. - [How to use Vercel’s Bot Management features](/kb/guide/how-to-utilize-vercels-bot-management-features): A practical, step-by-step guide to identifying unwanted automated traffic and securing your Vercel apps with Bot Protection Managed Rules, AI Bots Managed Rules, BotID, and custom WAF rules. Learn how to enable, monitor, and tune protections to block bad bots, preserve performance for real users, and safely allow good crawlers. - [How to effectively load test your application on Vercel](/kb/guide/how-to-effectively-load-test-your-vercel-application): Learn how to safely load test your Next.js app on Vercel. This guide covers realistic, policy-compliant testing of routes, caching, middleware, and databases to uncover performance issues without impacting Vercel’s infrastructure. - [Deploying and testing BotID](/kb/guide/deploying-and-testing-botid): This guide gives an overview on Vercel BotID and how to deploy and test it in production - [Supporting Compliance with Vercel WAF](/kb/guide/supporting-compliance-with-vercel-waf): Vercel Firewall provides edge-based traffic filtering and monitoring to help teams meet compliance requirements in security and regulatory frameworks, including PCI DSS, ISO 27001, SOC 2, and HIPAA. - [Troubleshooting request ECONNRESET errors](/kb/guide/troubleshooting-request-econnreset-errors): Understand what ECONNRESET means in Vercel runtime logs, why it happens when calling external APIs, how to diagnose it, and when to contact Vercel Support. - [How to conduct PCI scans on Vercel: A complete guide to IP safelisting](/kb/guide/how-to-conduct-pci-scans-on-vercel-guide): Scan and verify your Vercel deployments for secure, PCI-compliant payment processing. - [How to build and maintain HIPAA-compliant applications on Vercel](/kb/guide/hipaa-compliance-guide-vercel): Deploy HIPAA-compliant healthcare apps on Vercel with built-in security, BAAs, and scalable serverless infrastructure. - [How to protect your AI app from bots](/kb/guide/how-to-protect-your-ai-app-from-bots): Learn how to protect your AI app from bots, scrapers, and abuse using Firewall, BotID, and more. - [How to block bots from OpenAI GPTBot](/kb/guide/how-to-block-bots-openai-gptbot): Learn how to use the Vercel WAF to block, rate limit, or challenge traffic from OpenAI GPTBot. - [Securing your AI applications with Rate Limiting](/kb/guide/securing-ai-app-rate-limiting): Learn how to secure your AI applications with rate limiting using Vercel WAF and Vercel AI SDK - [Add rate limiting with Vercel](/kb/guide/add-rate-limiting-vercel): Learn how to implement rate limiting with Vercel. - [Penetration testing on Vercel](/kb/guide/penetration-testing-on-vercel): Learn how to perform pentesting on Vercel. - [Firewall Terraform Configuration](/kb/guide/firewall-terraform-configuration): Learn how to create scalable firewall configurations with Terraform ## Explore other topics in the Vercel Knowledge Base - [Agent Stack](/kb/agent-stack): Connect agents to any model, run multi-step work in durable workflows and isolated sandboxes, and give them scoped access to your data, tools, and chat apps. - [Docker](/kb/docker): Deploy HTTP applications from a standard Dockerfile with Vercel Functions, and run continuous background workers with Vercel Daemons. Find deployment and migration guides for both. - [Migrations](/kb/migrations): Learn how to migrate your application or agent to Vercel's agentic infrastructure. - [Vercel Sandbox](/kb/vercel-sandbox): The compute primitive designed to safely run untrusted or user-generated code on Vercel. ## Reference Architecture Choose a stack and work through the decisions behind it, with curated documentation, guides, templates, and courses to help you build. - [Agent stack](/kb/architecture/agents): Build and operate agents with models, tools, and durable workflows. - [Web applications](/kb/architecture/web): Choose rendering, data, authentication, and caching approaches. - [Backends](/kb/architecture/backends): Choose a runtime, connect services, and run background work. [Browse all stacks](/kb/architecture)