Vercel · Security
Scripts pretend to be browsers, copy your pages and pad your analytics. AI crawlers take bandwidth you pay for. Vercel’s bot rules challenge traffic that is not a real browser and can log or deny known AI crawlers. Both are off until you switch them on, and Google and other verified bots get through on their own.
Salesforce consulting partner since 2010 · MVP Hall of Fame · 200+ agents in production · UAE, India and US desks
The problem
What Bot Management is
Facts from Vercel’s own pages, checked on 16 October 2026. The sources are at the end of this page.
How it works
Five steps. Nothing is challenged until we have seen what the rule would catch.
Infographic
Step by step
Log
Turn on bot rules in Log mode
In Project, Firewall, the bot protection ruleset records what it would catch.
Review
Review the traffic it flags
Check that monitoring tools and partner feeds are not in the list.
Challenge
Switch to Challenge
Traffic that is not a real browser now has to prove it.
AI
Choose what AI crawlers get
Log them, or deny them if you do not want your pages in AI tools.
Allow
WAF bypass rules for your uptime monitor and partner webhooks. BotID on the forms that matter.
How it fits together
Scrapers, AI crawlers and real visitors all arrive at the same door. Bot rules sit at that door, in front of your site, Salesforce and your database. Verified bots like Google are let through. It only works when Vercel is the first stop, with no other proxy in front.
Infographic
Use cases · worked examples
How Bot Management fits into the work of the industries we serve, one step at a time.
Example 1 · Real estate, Bengaluru · Infographic
Today: Our new listings and floor plans show up on aggregator sites within a day, sometimes with the wrong price. Buyers call about numbers we never published.
After: The bot protection ruleset challenges scripts posing as browsers. Search engines still index the listings, and enquiries keep landing in Salesforce.
Worked example, step by step
Search still finds the listings, and enquiries go to the developer’s Salesforce, not a copycat’s inbox.
Example 2 · Marketing agencies, Austin · Infographic
Today: A client’s launch page showed a spike in visits and no extra leads. The client asked if we were padding the report.
After: Bot rules in Log mode show how much of the spike was scripts. Once they are challenged, the monthly report counts people.
Worked example, step by step
The client trusts the numbers again, because the agency can show where the fake visits went.
Example 3 · Couriers, Jeddah · Infographic
Today: Scripts check thousands of tracking numbers on our public page every hour. Customers say tracking is slow, and our merchant partners’ feeds time out.
After: Bot rules challenge the scripts. A WAF bypass rule keeps the merchants’ integration flowing, so partners keep their feed.
Worked example, step by step
Merchants keep their feed, customers get fast tracking, and the scrapers have to prove they are browsers.
Is it for you
Good fit
Not for you yet
What Mindcat does
The assessment is free: a short read of the org and a written note. If you go ahead, the first build week is a fixed AED/SAR 14,900 (about USD 4,050), credited in full when you sign the build within 60 days. After go-live, we keep it patched, watched and changing every month.
FAQ
Sources
Checked against Vercel’s own pages on 16 October 2026. Vercel changes fast, so we check again before any plan we write for you.
Vercel is a product of Vercel Inc. Mindcat builds and runs work on it for clients; we are not affiliated with or endorsed by Vercel.
Start here
One or two lines is enough. You hear back within 24 hours from the person who signs the work.
