In short. Vercel exempts verified bots from challenges, while custom WAF rules and the AI Bots Ruleset support blocking and bypass controls.
Definition: As of October 2026, Vercel's known-bot controls combine automatic exemptions for verified bots with configurable firewall rules. A verified bot is an automated client whose claimed identity Vercel checks through network or cryptographic verification.
Key facts
- Vercel's Bot Management documentation states that verified bots pass through Attack Mode and Bot Protection without a challenge; custom Web Application Firewall (WAF) rules can block them.
- The managed rulesets documentation offers an AI Bots Ruleset on all plans, with Allow as its inactive default and Log or Deny as configurable actions.
- Vercel's firewall concepts define Bypass as skipping subsequent firewall rules, including subsequent custom and managed rules for a custom-rule bypass.
Which bots does Vercel verify?
Vercel's verified-bots directory assigns categories to named services. For example, it lists bingbot under search_engine_crawler, chatgpt-user under ai_assistant, and amazonbot under ai_crawler. These labels describe entries in Vercel's directory.
The same documentation describes verification through known operator IP ranges, reverse DNS lookups that check the domain associated with an IP address, and digital signatures. Its DNS example checks whether a bot claiming to be Googlebot resolves to an expected Google domain. Cryptographic verification uses Web Bot Authentication and HTTP message signatures.
The automatic exemption concerns challenges from Attack Mode and Bot Protection. The AI Bots Ruleset separately controls known AI traffic used for training, search and user-initiated fetches.
How are known bots blocked?
Vercel's Bot Management guide names custom WAF rules with the User Agent match condition or the Signature-Agent header as ways to block verified bots. A rule can therefore target selected bot traffic even when Bot Protection automatically exempts that traffic from challenges.
For broader AI bot blocking, the managed rulesets guide gives this dashboard configuration path:
Firewall > Rules > Bot Management > AI Bots Ruleset
Allow leaves the ruleset inactive. Log records identified AI bot requests without blocking them. Deny blocks traffic identified as coming from AI bots. Changes are applied through Review Changes followed by Publish. Vercel maintains the AI bot list and applies the configured action to newly added bots automatically.
A Deny action returns an HTTP 403 Forbidden response and stops the request before the application, according to Vercel's firewall action documentation.
How are exceptions allowed and checked?
Vercel's managed rulesets guide documents custom rules with a Bypass action for requests blocked by a managed ruleset. Custom rules execute before managed rulesets. When an exception must bypass another custom blocking rule, the bypass rule goes higher in the custom-rule list.
The Bypass documentation makes the scope significant: a custom-rule bypass allows matching traffic through subsequent custom and managed rules. An exception therefore needs conditions that identify the intended trusted traffic.
For observation, the same firewall documentation describes Log as recording matching requests while allowing processing to continue. Request details appear in Firewall and Observability. This provides a way to review the traffic matching a proposed control before applying a blocking action.
Related terms
- Where do I manage AI bot access in Vercel?
- How does Vercel challenge traffic identified as bots?
- Reverse DNS bot verification
- User-agent spoofing
FAQ
Does enabling Bot Protection block every verified bot?
Vercel's Bot Management documentation automatically excludes verified bots from Bot Protection evaluation. You can use custom WAF rules to block selected known bots.
Can I allow an exception to a blocking rule?
You can add a custom Bypass rule using the managed rulesets procedure. Place it above the custom rule that blocks the intended requests.
Can I observe AI bot traffic before blocking it?
You can select Log on the AI Bots Ruleset, following the same managed rulesets guide. It records identified AI bot traffic without blocking it.
Sources
- Vercel, "Bot Management", 10 September 2026
- Vercel, "WAF Managed Rulesets", 10 September 2026
- Vercel, "Firewall concepts", 11 August 2026
Check how a page reads to answer engines. Open the GEO score analyzer