If you own your brokerage's website, it runs on Vercel, and your new listings show up on other sites the day you post them, this is for you. It is not for a site hosted somewhere else, or one that sits behind Cloudflare and will stay there: Vercel says its bot protection does not work behind a reverse proxy. Not sure which you have? Ask your web agency two questions: is the site on Vercel, and is Cloudflare in front of it. If the site still runs on an old server, this comes after the move; our hosting page sets out what a move involves.
What does bot protection stop, and what does it let through?
Copying can cost you leads, not just photos: if a copied listing carries someone else's number, a buyer's enquiry goes to them, not to your agent. Bot protection is the switch that makes copying harder. It challenges anything that claims to be a browser and does not behave like one. Vercel has two managed rulesets for bots, and both are available on every plan.
- Bot protection sends a JavaScript challenge to clients that break browser-like behaviour: a check the visitor's browser has to pass. A real browser passes it; a script that only claims to be a browser does not. Vercel's example is a
curlrequest that says it is Chrome. It runs in Log mode (record only) or Challenge mode. - AI bots recognises known AI crawlers, the ones that fetch pages for training, for search or because a person asked an assistant to read the page. It runs in Log or Deny mode, and Vercel keeps the list of bots up to date.
Both are off by default. Vercel's dashboard labels Bot protection "Off" and AI bots "Allow" until you change them, and until then that traffic reaches your site unchecked.
What gets through without a check is the list of verified bots. Google's crawler is the example Vercel gives. It checks each claim against the addresses the bot's owner publishes and, where the bot signs its requests, that signature. Search keeps working.
Should AI assistants read your listings?
Decide this on purpose, because the AI bots ruleset is one switch. Deny stops the known AI crawlers, and the docs describe that list as covering training, search and user-requested fetches alike.
Most sites want two things that pull apart: no training on their pages, and assistants that can still read and quote them when someone asks (that is the line we set for our own site). A buyer asking an assistant about two-bedroom flats in a community can only be sent to your listing if the assistant can read it.
So start in Log mode, which only records visits, and look at which AI bots actually come before you pick. If you want some and not others, your developer can write firewall rules for exactly the bots you name; Vercel's docs describe how. That is more work than one switch, and it is the way to say yes to search and no to training.
Why can WhatsApp link previews break?
Because WhatsApp may not be on the list of verified bots that skip the check. The evidence is one report, not Vercel's docs, which is why you test it on your own site. In a Vercel Community thread from December 2025, a site owner reported that WhatsApp previews stopped working once bot protection was on, even with the Facebook user agent allowed. A Vercel staff reply said this is "unfortunately expected for bots like Discord and WhatsApp, as they don't publish the IP ranges."
For a Dubai brokerage that is the whole sales channel. Agents share listing links on WhatsApp all day, and a bare link with no photo or title is a poor first look at a listing. Our real estate brokers page is built on that fact: every portal lead lands on the company's WhatsApp.
So test before Challenge goes on, not after an agent complains:
- 01Switch Bot protection on in Log mode only.
- 02Share three listing links in a WhatsApp chat, one new and two older ones, and check the photo and title appear.
- 03At a quiet hour, switch to Challenge and share the same links again.
- 04If previews break, switch back to Log at once and put a rate limit on the routes scrapers hit instead (priced on Pro from USD 0.50 per million allowed requests; our post on login and form rules covers how).
Vercel says firewall changes take effect worldwide within about 300 ms and can be rolled back to the earlier setting at once, so a failed test costs minutes, not an evening of broken links. We cannot promise you which way the test goes on your site, and neither can a vendor page. That is why it runs before the switch stays on, with your own listings and a person watching. (A preview link will not do for this test: when preview links are locked to your team, as we set them up, WhatsApp cannot fetch them either way.)
Is Cloudflare in front of your site?
Check before you plan anything else. Vercel's docs say bot protection does not work when Cloudflare, Azure or another CDN sits in front of the deployment as a reverse proxy. The proxy hides the signals the check relies on, real visitors get challenged by mistake, and proxies that rotate their exit addresses force a new challenge on every change.
Your web agency may have set this up years ago for speed or DNS. If your domain's traffic is proxied through Cloudflare, pick one layer for bots: Cloudflare's own tools, or Vercel's with the proxy switched off. Vercel's docs say detection degrades behind a proxy, so stacking the two does not add protection.
What does a first week look like for a brokerage?
A week of watching, then one day to switch: nothing is blocked until day 8. This is a sample plan for a Dubai brokerage site on Vercel, not a client's.
On cost: as of 16 October 2026, Vercel's pricing page shows both rulesets in every plan's column, so switching them on adds no line to the bill. A brokerage site is commercial, and Vercel's Hobby plan is for non-commercial use only, so it runs on Pro, at USD 20 a month (about AED 73) with one deploying seat and USD 20 of usage credit, or on Enterprise. Pro includes 1 million CDN requests and 1 TB of data transfer a month, extra deploying seats are USD 20 each, and viewer seats are free. So for a brokerage site that stays inside that traffic, with one in-house and one agency developer, the month is USD 40 (about AED 147), and these two rulesets add nothing to it. Vercel says traffic the firewall denies or challenges does not count toward CDN requests or data transfer. A visitor who passes the challenge and goes on to the page counts as normal. So blocking scrapers can only lower that part of the bill.
Two questions your clients may ask in writing. Where are the firewall logs? Vercel has no region in the UAE or Saudi Arabia and does not state where log data is stored, so if visitor records matter to a client, say that and drain the logs to a store you choose (our log retention post covers how). And how do you handle bots? A sample line to adapt: "Vercel's bot protection runs in Challenge mode on every page, AI crawlers are logged, and we review the firewall log every week." The rest of a questionnaire, and which answers Vercel's reports give, is in our security questionnaire post. Bot protection guards pages. Your enquiry form needs a different check, because a bot that fills it in is a fake lead, not a copied photo. That check is BotID, and our BotID page sets out where it fits.
What happens on the first call?
If you do not share listing links on WhatsApp and nobody copies your listings, the defaults are enough; come back when the logs say otherwise.
If you do, send us the site address and where leads go after the form. The written assessment is free: it says whether your site is on Vercel, whether a proxy sits in front, and whether this is two switches your agency can flip in an afternoon, in which case we say so. We call the method Preview every change: each change is tried first where your team can see it, here a Log-mode week and a watched test with your own listings, before it stays on for buyers. You hear back within 24 hours from the person who signs the work. For everything else we build on the platform, see everything we build on Vercel. If it is two switches, there is nothing to buy. If you want us to build more on the site, the first build week is a fixed AED/SAR 14,900, credited in full if you sign the build within 60 days. Run plans are on What you get. We are not a Vercel partner; Vercel is the product we build on.
