Cloud platform Vercel has officially implemented a new policy, completely waiving CDN request and Fast Data Transfer costs for traffic blocked or rate-limited by WAF. This change aims to protect customers from financial risks arising from DDoS attacks and botnets.
Background
In traditional pricing models, attacks from botnets or scrapers can generate millions of fake requests. Although WAFs can block this traffic, users often still have to pay for the bandwidth those requests consume. Vercel stated that they want to eliminate the anxiety of "surprise bills" for developers when facing large-scale attacks.
Developments
Under this policy, all projects on Vercel will automatically be exempt from charges for traffic that is Denied, Challenged, or Rate-limited by WAF, with no configuration required. Vercel's system will automatically detect and exclude costs related to this junk traffic from monthly invoices. This is an extension of their previous commitment to provide free, unlimited DDoS mitigation.
Why It Matters
This is excellent news for Vietnamese tech startups operating on Vercel. Eliminating the financial risk from credential-stuffing attacks allows businesses to scale with peace of mind. However, engineers should still monitor WAF rule effectiveness to ensure genuine users are not mistakenly blocked in the effort to optimize costs.