Bot Protection

Bots generate nearly half of all internet traffic, with many originating from malicious sources. These automated threats scrape content, attempt unauthorized logins, or overload servers. Bot protection mitigates these risks by distinguishing between verified bots and potentially harmful automated traffic.

Bot protection systems analyze incoming traffic to identify whether a request originates from a real user, a trusted bot like a search engine crawler, or an unknown automated source.

• Allowing legitimate bots that correctly identify themselves
• Challenging suspicious traffic that behaves abnormally or does not resemble real browser activity
• Enforcing browser-like behavior by verifying navigation patterns and cache usage

To filter out harmful bot traffic, various techniques are used, including:

• Signature-based detection: Inspecting HTTP requests for known bot signatures
• Rate limiting: Restricting how often certain actions can be performed to prevent abuse
• Challenges: Using JavaScript checks to verify human presence
• Behavioral analysis: Detecting unusual patterns in user activity that suggest automation

With Vercel, you can use:

• Managed rulesets to challenge specific bot traffic
• Rate limiting and challenge actions with WAF custom rules to prevent bot activity from reaching your application

With Vercel, you can use the bot filter managed ruleset to challenge non-browser traffic from accessing your applications. It filters out automated threats while allowing legitimate traffic.

• It identifies clients that violate browser-like behavior and serves a javascript challenge to them.
• It prevents requests that falsely claim to be from a browser such as a curl request identifying as Chrome.
• It automatically excludes verified bots, such as Google's crawler, from evaluation.

To learn more about how the ruleset works, review the Challenge section of Firewall actions. To understand the details of what get logged and how to monitor your traffic, review Firewall Observability.

You can apply the ruleset to your project in log or challenge mode. Learn how to Configure bot filter managed ruleset.

Vercel maintains and continuously updates a comprehensive directory of known legitimate bots from across the internet. This directory is regularly updated to include new legitimate services as they emerge. Attack Challenge Mode and bot filter automatically recognize and allow these bots to pass through without being challenged. You can block access to some or all of these bots by writing WAF custom rules with the User Agent match condition. To learn how to do this, review WAF Examples.