Attack Mode

Attack Mode is a security feature that protects your site during DDoS attacks. When enabled, visitors must complete a security challenge before accessing your site, while known bots (like search engines and webhook providers) are automatically allowed through.

The Vercel Firewall automatically mitigates against DDoS attacks, but Attack Mode provides an extra layer of protection for highly targeted attacks.

Attack Mode is available for free on all plans and requests blocked by Attack Mode do not count towards your usage limits.

Vercel maintains and continuously updates a comprehensive directory of known legitimate bots from across the internet. Attack Mode automatically recognizes and allows these bots to pass through without being challenged.

Review Verified bots for examples of bot categories and services that are automatically allowed. Internal Requests are also allowed through.

Vercel's bot directory is regularly updated to include new legitimate services as they emerge, ensuring your SEO, analytics, integrations, and essential services continue to function even with Attack Mode enabled.

When Attack Mode is enabled, requests from your own Functions and Cron Jobs are automatically allowed through without being challenged. This means your application's internal operations will continue to work normally.

For example, if you have multiple projects in your Vercel account:

• Your projects can communicate with each other without being challenged
• Only requests from outside your account will be challenged
• Each Vercel account has its own secure boundary

Other Vercel accounts cannot bypass Attack Mode on your projects. The security is strictly enforced per account, ensuring that only your own projects can communicate without challenges.

While Vercel's Firewall automatically monitors for and mitigates attacks, you can enable Attack Mode during targeted attacks for additional security.

To enable:

1. Select your project from the Dashboard.
2. Open Firewall in the sidebar.
3. Click Bot Management.
4. Under Attack Mode, select Enable.

All traffic initiated by web browsers, including API traffic, is supported. For example, a Next.js frontend calling a Next.js API in the same project will work properly.

Attack Mode can be safely used for extended periods without affecting search engine indexing or webhook functionality. However, since Vercel's Firewall already provides automatic DDoS protection, we recommend using it primarily when facing highly targeted attacks rather than as a permanent setting.

When you no longer need the additional protection:

1. Select your project from the Dashboard
2. Open Firewall in the sidebar.
3. Click Bot Management.
4. Under Attack Mode, select Disable.

For more granular control, define a Custom Rule with the Vercel WAF to challenge specific web traffic.

Search engine crawlers like Googlebot are automatically allowed through Attack Mode without being challenged. This means enabling Attack Mode will not negatively impact your site's SEO or search engine indexing, even when used for extended periods.

Attack Mode is available for free on all plans.

All mitigations by Attack Mode are free and unlimited, and there are zero costs associated with traffic blocked by Attack Mode.