Link to headingCountering the threat of bad bots

Automation plays a key role in how the internet works. While some bots serve useful functions, like crawling and indexing, it’s estimated that nearly one-third of internet traffic is malicious bot activity. They’ve become some of the biggest security threats facing developers, security teams, and end-users today.

To counter automation at this scale, there’s no one-sized fits all approach. Teams need a variety of tools and mitigation techniques to stop bad bots.

Link to headingEvolving our bot protections

Vercel provides bot mitigation as part of our secure by default platform.

• Our platform-wide DDoS mitigations block traffic from botnets behind DDoS traffic, HTTP floods, and malformed requests

• Firewall templates let users deploy rules targeting known bad actors, from open source blocklists to common AI scrapers

• Attack Challenge mode can be used to challenge requests during highly-sophisticated or targeted attacks

However, as automated attacks become more advanced, teams require more targeted protections that are always on and always adapting.

Link to headingIntroducing Bot Protection

The Bot Protection managed ruleset gives you the ability to stop unwanted bot traffic, while allowing business-critical bots through. This new security layer goes beyond our platform protections to give you greater control over the type of traffic accessing you applications.

Link to headingHow Bot Protection works

The Bot Protection ruleset takes a proactive approach using a heuristics-based detection. It quickly distinguishes between browser-based traffic (human) or non-browser based (likely bot) traffic with zero configuration needed. When enabled:

• Requests from real browsers and verified bots are allowed through, including internal sources like project cron jobs and API calls from your functions. We publish additional information about verified bots on bots.fyi.

• Requests from non-browser clients, like curl or unwanted scrapers, can be issued a challenge

Bot Protection ties directly into the WAF. As a managed ruleset, we maintain the list of verified bots to ensure authenticity and reduce maintenance overhead.

Link to headingWhen to use Bot Protection

Use Bot Protection to restrict access to your sites to human users and Vercel-verified bots. It’s ideal for legitimate services like AI and SEO bots, or when you expect mostly human traffic. Bot Protection continuously challenges non-browser traffic, improving app performance and optimizing resource usage for real customers.

We recommend you enable Bot Protection in Log-Only Mode first to gain visibility into your app's traffic and bot sources by showing what requests would be challenged. For legitimate automated traffic not covered by verified bots list, you can use custom WAF rules with the bypass action to ensure that this traffic reaches your app.

Bot Protection is not designed to defend against sophisticated bots that mimic human and browser behavior. Should you want to issue a challenge to all traffic to block automation entirely, use Attack Challenge Mode instead.

Link to headingWhat’s next for bot management

Link to headingPublic Beta Feedback

During this public beta period, we’ve set up a thread on the Vercel Community where you can share your feedback, feature requests, and experiences with Bot Protection.

Link to headingLooking ahead

Bot management plays a key role in strengthening our secure by default platform. AI agents and other automated tools are only increasing, and the rising volume of sophisticated bot traffic will change the way developers build, operate, and secure apps.

Our planned bot management updates for the Vercel Firewall focus on specific attack types and better end-user experiences. Additional features include deeper observability into bot traffic, more granular control over verified and AI bots, Bot Protection SDK, and runtime bot protection capabilities. Enterprise users looking for more granular control will also get access to underlying detection signals as configurable inputs in the Firewall for more advanced control over automated traffic.

Link to headingEnable Bot Protection today

You can enable the Bot Protection from your Firewall's Configure dashboard.

If you're just getting started with Vercel Firewall, or don't yet have a clear picture of your app's traffic patterns, start in Log-Only Mode so you can refine your allowlist before switching to active enforcement.

If you are a SaaS provider and want to add your bot to our verified bots list, you can reach out to us at https://bots.fyi/.

Learn more in the changelog or read the documentation.

Edit: During the beta period, we renamed the Bot Filter managed ruleset to Bot Protection