Vercel project has rate limiting rules configured

​

What this check verifies

Vercel projects are assessed for rate limiting rule configuration. Rate limiting protects applications from abuse, brute-force attacks, and DDoS attempts by restricting the number of requests from a single source within a given time window.

​

Risk

Without rate limiting, the application is vulnerable to brute-force attacks on authentication endpoints, API abuse, resource exhaustion, and denial-of-service attacks. Attackers can overwhelm the application with excessive requests, degrading performance for legitimate users or exploiting endpoints without throttling.

​

Recommendation

Configure rate limiting rules to protect critical endpoints such as authentication, API routes, and form submissions. Start with conservative thresholds and adjust based on traffic patterns to avoid blocking legitimate users.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > Security > Firewall
3. Add a new rate limiting rule
4. Configure the request threshold, time window, and action (challenge or block)
5. Apply the rule to appropriate paths (e.g., /api/*, /login)

​

References

• https://vercel.com/docs/security/vercel-firewall

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = security_rate_limiting_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks