Vercel project has the Web Application Firewall enabled

​

What this check verifies

Vercel projects are assessed for Web Application Firewall (WAF) enablement. The WAF provides protection against common web attacks including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats.

​

Risk

Without the Web Application Firewall enabled, the application is directly exposed to common web attacks including SQL injection, cross-site scripting, request smuggling, and other exploits. Attackers can exploit these vulnerabilities to steal data, deface the application, or gain unauthorized access.

​

Recommendation

Enable the Vercel Web Application Firewall to protect your application against common web attacks. Start with managed rulesets for baseline protection and add custom rules as needed based on your application’s threat model.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > Security
3. Enable the Web Application Firewall
4. Configure appropriate rules and managed rulesets
5. Monitor firewall logs for false positives and adjust rules accordingly

​

References

• https://vercel.com/docs/security/vercel-firewall

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = security_waf_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks