How to protect your Vercel site from attackers

Learn how you can quickly lock down traffic and further protect against DDoS attacks by challenging requests, minimizing the chance that malicious bots get through, with Vercel's Attack Challenge Mode.

0:00 – Introduction
0:17 – Attack Challenge Mode
0:49 – Demo
1:47 – Rate Limiting
2:05 – Spend Management
2:35 – Conclusion

#vercel

[-way]

Vercel's answer to $104, 000 Netlify bill on serveless horrors

[utuberlol]

This is great to see, youre always listening to your costumers and iterating

[DominikSipowicz]

As always amazing content! Thanks Lee!

[rhysyw]

If the rate limiting is in the middleware, Vercel charges per-middleware invocation so you'd still incur a potential large bill if the rate limit is triggered a lot?

[zhanezar]

really great work guys, always believed you would find a way to help with these horror stories on twitter.

[philipaarseth]

Would be nice to add a toggle so that you can either let it turn on automatically (and off when spike usage dies down) and notify admin OR notify admin on usage spike and ask if mode should be enabled.

[yassine-sa]

It would be very interesting to have an option to automatically turn on this mode when the number of requests are over a certain limit or sth like that, maybe when the number of requests is greater than 3 times the avg for example, you get the drill

[AjaySingh-jzqx]

Is it still going to work on advanced ddos attacks

[cguser]

can vercel send notification when there's a vulnerability checked found?

[julienben]

Great to have this! Quick question: Is there any way to turn it on without breaking uptime monitoring? Somehow?

[freakinmonkey]

Does attack challenge mode also protect api routes?

[kasper]

It's taking longer to verification

[pranshubasak]

Just add a button restric bill thats it, is it to much to ask

[JamesJGoodwin]

What are the advantages of Attack Challenge Mode compared to Cloudflare "I'm under attack" mode?

[koko]

Can we have proper CSP documentation? Nothing is working out of the box (fresh install + documentation followed)