Is Skew Protection on by default for SvelteKit?

Vercel says projects created after 19 November 2024 with a supported framework already have it on. Older projects must switch it on under Settings, then Advanced, and redeploy production. It is available on Pro and Enterprise only, and SvelteKit needs @sveltejs/adapter-vercel version 5.2.0 or later.

Should I use adapter-auto or adapter-vercel?

adapter-auto detects Vercel and installs the Vercel adapter at build time. Vercel recommends installing @sveltejs/adapter-vercel yourself, to keep the version stable, speed up CI slightly, and set default deployment options for every route. Pin it in package.json, so a build next month uses the same adapter as today.

Can SvelteKit run in the UAE on Vercel?

Not as compute. Vercel lists 19 compute regions, and none is in the UAE or Saudi Arabia. Mumbai (bom1) is the nearest. You can set the runtime and region per project or per route, so put server routes next to the database they read.

Do I need to split my SvelteKit routes into separate functions?

Usually not. By default SvelteKit bundles routes into one Vercel Function, which means fewer cold starts. Vercel says split: true is not typically better, and suggests it only when the bundle exceeds the function size limit or cold starts are unusually long.

Forms lost when you deploy? A fix to check

Visitors lose half-filled forms when you deploy? How SvelteKit on Vercel keeps them

Written forHead of digital, IT manager, or founder who owns the company website or web app, signs the hosting bill and answers client security questionnaires“Our site and web app live on an old server, and the security questionnaire is due.”

If your team ships SvelteKit fixes during working hours while patients, tenants or buyers are halfway through a form, this is for you. The fix is one setting and one package version, and you can check both today.

What happens to a visitor when you deploy mid-session?

A deploy in working hours can cost you the bookings that were half typed at that minute. Here is how. A visitor opens your booking page at 10:58. At 11:00 your team ships a fix. The visitor's browser still runs the old version, and its next request now reaches a server that only has the new one. Vercel calls this version skew.

SvelteKit has its own answer, and it is a blunt one. Vercel's SvelteKit page says that when SvelteKit detects version skew, "it triggers a hard reload of a page to sync to the latest version. This does mean the client-side state gets lost." In plain terms: whatever the visitor typed and had not submitted is gone.

With Vercel Skew Protection switched on, "client requests get routed to their original deployment. No client-side state gets lost." The visitor finishes on the version they loaded. The next full page load gets the new one.

Without Skew Protection the page reloads and the form is empty; with it the visitor finishes on the version they loaded — What a visitor sees during a deploy, from Vercel's SvelteKit docs.

For what SvelteKit gets on Vercel and how it connects to your other systems, see SvelteKit on Vercel.

What does Skew Protection cover, and what does it miss?

It covers the requests the framework makes for you. It does not cover everything, and the gaps are where forms still break.

Which plansPro and Enterprise. Not Hobby

On by default?For projects created after 19 November 2024 with a supported framework. Older projects switch it on and redeploy

SvelteKit version needed@sveltejs/adapter-vercel 5.2.0 or later

What it pinsStatic assets, client-side navigations and prefetches the framework makes

What it does not pinYour own fetch() calls from the browser, unless you pass the deployment ID yourself

Full page loadsA hard refresh or a new tab always gets the latest production version

How longOne day after the deployment by default; you can raise it up to your deployment retention

Skew Protection pins framework requests, but not your own fetch calls or a full page reload; default age one day — What Skew Protection covers and misses, from Vercel's docs.

The fetch() gap is the one we look for first. Requests the framework makes for you are pinned. A form an agency wired to a hand-written fetch('/api/book') is not, unless the code adds the deployment ID; Vercel's docs show how, with a ?dpl= parameter or an x-deployment-id header. Ask your developer how each form submits, then test it with a deploy.

What should you ask your developer to set?

Three settings, all in one file, svelte.config.js. You do not need to read it; forward this list to whoever does.

Pin the adapter. New projects use adapter-auto, which installs the Vercel adapter at build time. Vercel recommends installing @sveltejs/adapter-vercel yourself "to ensure version stability". That is also how you guarantee 5.2.0 or later.
Set the runtime on purpose. You can set it for the whole project or per route, for example nodejs24.x or edge. Put routes that read your database in the region nearest to it. Vercel has 19 compute regions and none in the UAE or Saudi Arabia; Mumbai (bom1) is the nearest.
Leave split alone. SvelteKit bundles routes into one function by default. Vercel says splitting "is not typically better" and suggests it only for size limits or long cold starts.

One detail that catches agencies: Vercel notes you cannot use TypeScript for the SvelteKit config file. It stays svelte.config.js.

What does it cost to run?

Skew Protection is a project setting on Pro and Enterprise, so the real cost question is the plan. As of 16 October 2026, Pro is USD 20 a month with one deploying seat and USD 20 of usage credit. Extra deploying seats are USD 20 a month each, viewer seats are free, and usage above the credit is metered. Hobby is for non-commercial, personal use only, and it has no Skew Protection.

In one line: USD 20 a month for each deploying seat, and well under a dollar of usage for the sample below, inside the included credit. Our arithmetic for the clinic example below, from list prices at Mumbai rates, not a measured bill. Assume 30,000 form requests a month, each 50 ms of Active CPU and 2 GB held for 200 ms. That is 0.42 CPU hours (USD 0.06), 3.3 GB-hours (USD 0.04) and USD 0.02 of invocations: about USD 0.12, inside the USD 20 credit. The plan fee and seats are the bill.

We are not a Vercel partner and earn nothing from your Vercel bill. Our own site runs on Netlify. What stays portable: the app is plain SvelteKit, and swapping adapter-vercel for another adapter moves it. What does not move: Skew Protection, which is Vercel's.

So a clinic or brokerage running on a free account has two problems: the plan does not allow commercial use, and deploys can wipe forms.

What does this look like for a clinic booking form?

Take a sample clinic in Dubai with a four-step SvelteKit booking form: doctor, time, insurance, contact details. This is an illustration, not a client story.

0110:58. A patient opens the form on a phone and picks a doctor and a time.
0211:00. Staff ship a fix that adds a new insurer to the insurance list.
0311:02. Without Skew Protection, the next step can trigger a hard reload, and the patient starts again or gives up.
0411:02. With Skew Protection on, the patient's requests stay on the 10:58 version and the booking goes through.
0511:05. The next patient who opens the page sees the new insurer.

A clinic example: a patient fills a booking form, a fix ships at 11:00, the patient still submits and staff see it — A worked example for a clinic. Illustrative, not a client story.

The times are part of the example, not a measured result. If no-shows and double bookings are the bigger problem, a form fix will not cure them. See how we work with clinics, and Mindcat Bookings for staff calendars.

What goes on the security questionnaire?

Vercel splits the answers in its shared responsibility model, read on 16 October 2026. Here is who writes each line.

Platform certificationsVercel. It holds a SOC 2 Type 2 attestation and ISO 27001:2022; reports are at security.vercel.com. They cover Vercel's platform, so request them from Vercel

Network, infrastructure, encryption in transit and at restVercel, for the services it runs

Where data is processedYou. You pick the function region. None is in the UAE or Saudi Arabia; Mumbai (bom1) is the nearest. Your database is wherever you put it

Logins, keys and source codeYou. Vercel holds environment variables; who can read them is your team setting

Logs kept long termYou, through a log drain. Vercel keeps short-term runtime logs

Cost of bad trafficYou. Vercel's model says the customer pays for malicious traffic, so set a spend limit

If a contract says data must be processed inside the UAE, Vercel cannot meet it today. Say so before you sign, not after.

For a bad month, set Spend Management. Vercel sends alerts at 50%, 75% and 100% of the amount you set, and pauses production when you reach it if Pause Production Deployments is on. A budget alone does not stop usage, and the check can lag by several minutes. If a change breaks the site, Instant Rollback on Pro returns production to any earlier production deployment from the dashboard; environment variable changes are not rolled back with it.

What do you check before you ship in working hours?

Run through these once. Each takes minutes.

01The team is on Pro or Enterprise, not Hobby.
02Skew Protection is on under Settings, Advanced, and production was redeployed after switching it on.
03@sveltejs/adapter-vercel is pinned in package.json at 5.2.0 or later.
04Any hand-written fetch() from the browser passes the deployment ID.
05The maximum age covers your longest session. One day is the default.
06One deploy tested with a half-filled form open on a phone.

If you deploy once a month, at night, and nobody is mid-form when you do, this is not your problem yet; spend the time elsewhere.

What happens on the first call?

We call the method Preview every change: each change gets its own preview link, someone on your side approves it on a phone, then it goes live, and any release can be rolled back. Send us the app and where it runs today. The written assessment is free and says what to change, what to keep and what it costs to run. The first build week is a fixed AED/SAR 14,900, and a Run plan keeps the app patched and shipping afterwards. More on how we build and run apps is on our Vercel page.