#0001
`Vercel` stops charging for WAF-mitigated traffic
90radar
VercelFrontend cloud platform — integrated Next.js deploys and CDN
Blocked bots no longer turn into surprise CDN bills. This directly lowers the risk of scrapers, credential stuffing, and abused API endpoints on small apps.
- Traffic denied, challenged, or rate-limited by
Vercel Firewallnow waives CDN Requests and Fast Data Transfer charges. - DDoS mitigation was already unlimited and free; this change covers non-DDoS abuse handled by custom rules, managed rules, and rate limits.
- The waiver applies automatically to every project using
Vercel Firewall; no config change or migration required. - Product pages, login routes, and expensive API endpoints are the obvious places to add stricter rules now.
Source: vercel.com/changelog/web-application-firewall-mitigated-Read original →
