In short. Manage known AI bot requests through AI Bots Ruleset in the project Firewall dashboard, then review and publish the changes.
Definition: As of October 2026, Vercel manages AI bot access through the AI Bots Ruleset in each project's Firewall settings. This managed ruleset identifies known AI bots and offers Allow, Log, and Deny settings.
Key facts
- Vercel's Bot Management documentation says the AI bots ruleset covers requests for training data, search, and user-generated fetches. Vercel maintains and updates the list automatically.
- The managed rulesets guide places AI Bots Ruleset under Firewall, Rules, then Bot Management. It is available on all plans and defaults to Allow.
- Vercel's firewall action definitions state that Deny returns a
403 Forbiddenresponse and prevents the request from reaching the application. - The Firewall Observability guide describes traffic filters by rule and action, with breakdowns by user agent and request path.
Where are the controls, and how are changes applied?
Vercel's configuration instructions give this dashboard path, starting inside the relevant project:
Firewall > Rules > Bot Management > AI Bots Ruleset
The same guide describes these settings:
- Allow leaves the ruleset inactive. Matching traffic reaches the application without evaluation by this ruleset.
- Log records identified AI bot traffic without blocking it.
- Deny blocks all traffic identified as coming from AI bots.
After a setting changes, Review Changes opens the pending changes for review. Publish applies them to the production deployment. Configuring, saving, and applying rules requires the Project administrator, Team member, or Security role, according to the guide.
How do AI bot controls relate to other firewall actions?
Vercel's Bot Management documentation describes a separate Bot Protection ruleset. It defaults to Off and offers Log or Challenge. It targets non-browser traffic and automatically excludes verified bots, such as Google's crawler, from evaluation.
A challenge checks whether a client can execute browser JavaScript. Vercel's firewall concepts guide says successful verification creates a browser challenge session, while a failed challenge blocks the request before it reaches the application. Direct automated API requests requiring challenge validation fail outside a valid session.
The same guide defines Bypass, an action available to custom rules, as skipping subsequent firewall rules. A custom bypass allows matching requests through later custom and managed rules. This gives a trusted exception a broad effect that matters when selecting which traffic matches it.
How can traffic be checked after a change?
Vercel's Firewall Observability documentation describes the project's Traffic page. The rule selector above the graph filters traffic to a specific rule; action tabs filter it by the action applied.
The User Agents breakdown groups clients by their user-agent strings, while Request Paths groups requests by URL path. Together with the rule and action filters, these views identify which traffic matches the selected control and which parts of the site receive it. The Overview page also summarizes active rules and associated events.
Related terms
- How does Vercel challenge traffic identified as bots?
- How do I control known bots in Vercel?
- robots.txt
FAQ
Can I observe AI bot traffic before blocking it?
Yes. You can select Log on AI Bots Ruleset. Vercel's managed rulesets guide states that this records AI bot traffic without blocking it.
Does a custom Bypass rule skip only AI bot filtering?
Vercel's Bypass definition says a custom bypass allows matching requests through subsequent custom and managed rules. You should account for that scope when configuring a trusted exception.
Sources
- Vercel, "Bot Management", 10 September 2026
- Vercel, "WAF Managed Rulesets", 10 September 2026
- Vercel, "Firewall concepts", 11 August 2026
- Vercel, "Firewall Observability", 10 September 2026
Check how a page reads to answer engines. Open the GEO score analyzer