In short. Vercel Bot Protection challenges suspected non-browser traffic with JavaScript verification and creates a browser session valid for one hour after success.
Definition: As of 17 October 2026, Vercel's Bot Protection managed ruleset can serve a JavaScript security challenge to traffic identified as unlikely to come from a browser. The challenge requires browser verification before the request continues through the firewall.
Key facts
- Vercel's Bot Management documentation says Bot Protection detects clients that violate browser-like behavior and automatically excludes verified bots from evaluation.
- The WAF Managed Rulesets documentation provides Log and Challenge actions for Bot Protection, and Log and Deny actions for the AI Bots ruleset.
- Vercel's Firewall concepts documentation gives successful challenge sessions a validity of one hour and ties them to the browser that completes verification.
- The Firewall Observability documentation describes traffic filters by rule and action, with request grouping by user agent and request path.
Which managed action applies?
A managed ruleset is a collection of predefined web application firewall (WAF) rules. Vercel's managed ruleset instructions identify Bot Protection's default state as Off. Selecting Log records matching requests while allowing them through; selecting Challenge serves JavaScript verification to traffic unlikely to be a browser.
The AI Bots ruleset has a separate default state, Allow. Its Log action records identified AI bot traffic, while Deny blocks it. The Bot Protection Challenge setting therefore serves a different purpose from the AI Bots Deny setting.
Vercel's bot documentation gives a curl request identifying as Chrome as an example of false browser identification. It also documents automatic exemptions for verified bots, such as Google's crawler. Verification can involve known IP addresses, reverse DNS lookup or cryptographic signatures.
What happens at the security checkpoint?
According to Vercel's challenge documentation, the visitor sees a Vercel Security Checkpoint screen. The browser executes JavaScript, computes a solution and submits it; Vercel also validates browser characteristics.
Successful verification lets the request continue, including evaluation of additional WAF rules. Failure blocks the request before it reaches the application. Subsequent requests use the browser's valid challenge session, including API requests made during that session. After expiration, the client must solve the challenge again.
The same documentation says direct API calls from scripts, cURL or Postman fail when challenge validation is required outside a valid session. For a challenged API route, browser verification is therefore part of the access requirement.
Where are challenges configured and inspected?
Vercel's configuration instructions give this dashboard path:
Firewall > Rules > Bot Management > Bot Protection
The Bot Protection control offers Log or Challenge. Review Changes displays pending edits, and Publish applies them to the production deployment.
The Firewall Observability guide describes the Traffic page's rule and action filters. Grouping requests by User Agents or Request Paths helps locate the clients and URLs affected by a rule. The Overview page also exposes events that expand into requests from the affected client.
For trusted automation, Vercel's bot management guide documents custom WAF rules with a bypass action that skips Bot Protection. The same guide warns that a reverse proxy in front of a Vercel deployment masks detection signals and can cause legitimate visitors to face challenges or repeated verification when proxy exit IPs change.
Related terms
- Where do I manage AI bot access in Vercel?
- How do I control known bots in Vercel?
- JavaScript rendering and AI crawlers
FAQ
Can you use Log before enabling challenges?
Yes. Vercel's Log action documentation says matching requests proceed normally while their details appear in Firewall and Observability. This allows monitoring before stricter actions are applied.
How can you allow a trusted automated client?
Vercel's ruleset bypass instructions describe a custom WAF rule with a bypass action targeting the relevant requests. Custom rules execute before managed rulesets.
Sources
- Vercel, "Bot Management", 10 September 2026
- Vercel, "WAF Managed Rulesets", 10 September 2026
- Vercel, "Firewall concepts", 11 August 2026
- Vercel, "Firewall Observability", 10 September 2026
Check how a page reads to answer engines. Open the GEO score analyzer