How to block AI bots on Vercel
Vercel's Firewall has an AI Bots Managed Ruleset, available on all plans, that you can set to Log or Deny. It is off by default (shown as Allow). Deny blocks all traffic Vercel identifies as AI bots, so it also blocks the AI search bots you may want.
By the Crawlerpeek editorial team · Updated · How we check
Steps
- Open your project in the Vercel dashboard and choose Firewall in the sidebar, then Rules.
- In the Bot Management section, set the AI Bots Ruleset rule to Log or Deny. Log records AI bot traffic without blocking it, which is useful for monitoring first.
- Select Review Changes and then Publish to apply the change to production.
Source: Vercel: WAF Managed Rulesets (page last updated 2026-09-10 when we read it). Vercel also offers a separate Bot Protection ruleset, which serves a JavaScript challenge to traffic that is unlikely to be a browser, and custom rules that can match a user agent.
Things to watch
- Deny applies to all AI bots the ruleset identifies, without distinguishing training from search. If you want AI search visibility, start with Log, or use robots.txt for per-bot control.
- If a ruleset blocks a request you want, Vercel documents a bypass action in a custom rule.
- Keep robots.txt in step with the firewall; the generator helps.
Other platforms: Cloudflare, nginx, Apache.
See how your own site does.Run the checker