Vercel project has custom firewall rules configured

​

What this check verifies

Vercel projects are assessed for custom firewall rule configuration. Custom rules allow fine-grained control over traffic based on request attributes such as path, headers, user agent, and geographic location, providing application-specific protection beyond managed rulesets.

​

Risk

Without custom firewall rules, the application lacks application-specific traffic filtering. Generic managed rulesets may not cover all threat vectors unique to the application. Custom rules are needed to block known attack patterns, restrict access to sensitive paths, and enforce application-level security policies.

​

Recommendation

Configure custom firewall rules to protect application-specific endpoints and enforce security policies. Focus on protecting admin panels, API routes, authentication endpoints, and any paths that handle sensitive data.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > Security > Firewall
3. Add custom rules to protect sensitive endpoints
4. Configure conditions based on path, headers, geographic location, or other request attributes
5. Set appropriate actions (block, challenge, or allow) for each rule

​

References

• https://vercel.com/docs/security/vercel-firewall/custom-rules

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = security_custom_rules_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks