# Firewall-mitigated traffic is free on Vercel

DevFeed: [Firewall-mitigated traffic is free on Vercel](<https://devfeed.tech/articles/firewall-mitigated-traffic-is-free-on-vercel-1196.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/web-application-firewall-mitigated-traffic-is-free-on-vercel>)

Author: Pranav Kanchi

Published: 2026-05-18T20:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Firewall](<https://devfeed.tech/topics/firewall.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [cdn](<https://devfeed.tech/tags/cdn.md>), [cost](<https://devfeed.tech/tags/cost.md>), [ddos](<https://devfeed.tech/tags/ddos.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [vercel](<https://devfeed.tech/tags/vercel.md>)

## AI overview

Vercel Firewall now waives CDN request and Fast Data Transfer charges for traffic that its WAF denies, challenges, or rate-limits. The change applies automatically to all projects using Vercel Firewall.

## Source excerpt

Vercel Firewall now waives CDN Requests and Fast Data Transfer for any traffic denied, challenged, or rate-limited by Web Application Firewall (WAF). Vercel has always provided unlimited DDoS mitigation at no cost. Vercel WAF, included in CDN cost, gives you custom rules, managed rules, and rate limiting for bad traffic that isn't DDoS. With this change, you don't pay for requests or bandwidth that WAF denies, challenges, or rate-limits. That means no surprise bill when a scraper hammers your product pages, a credential-stuffing botnet hits your login route, or a bot abuses an expensive endpoint. The waiver applies automatically to every project using Vercel Firewall and no configuration is required. Learn how to implement WAF rules in the Firewall documentation. Read more