sincecutoff.com
/v1/json /v1/md llms.txt
← all changes

vercel firewall manages project firewall configuration

Introduced 2026-05-06 · score 0.92

HOW TO USE IT

When managing a project firewall, use `vercel firewall` subcommands to view and change rules, IP blocks, system bypass, attack mode, or system mitigations. Rule and IP block changes are staged; review with `vercel firewall diff` and publish with `vercel firewall publish --yes`.

vercel firewall rules add "<rule-name>" --condition '<condition-json>' --action <action> --yes
vercel firewall rules edit "<rule-name>" --action <action> --yes vercel firewall rules enable "<rule-name>" vercel firewall rules disable "<rule-name>" vercel firewall rules remove "<rule-name>" --yes vercel firewall rules reorder "<rule-name>" --position <1-based-position> --yes
vercel firewall diff vercel firewall publish --yes

WHY THIS HELPS

Manage a project's firewall configuration from the Vercel CLI.

REQUIREMENTS AND LIMITATIONS

  • Version: 53.2.0
  • `rules add` positional `<rule-name>` (required): Name of the new rule.
  • `--condition <condition-json>` (required): Condition object with required `type` and `op`; `value` is required for most operators, and `key` is required for `header`, `cookie`, or `query`. `neg` is optional and defaults to false. Repeated conditions in a group are ANDed.
  • `--or`: Starts a new OR condition group; condition groups are ORed.
  • `--action <action>` (required): Rule action: `deny`, `challenge`, `log`, `bypass`, `rate_limit`, or `redirect`.
  • `--yes`: Shown in documented examples for non-interactive mutation commands; detailed flag semantics not found.
  • `rules edit` positional `<rule-name>` (required): Name of the rule to edit; `--condition` replaces all its conditions.
  • `--enabled` / `--disabled`: Enable or disable a rule via `rules edit`.
  • `rules reorder` positional `<rule-name>` (required): Rule to move in evaluation priority order.
  • `--first` / `--last` / `--position <n>` (required): Selects the destination order; the docs show these as alternatives, but do not explicitly state mutual exclusivity. Position is 1-based.
  • `ip-blocks block <IP-or-CIDR>` (required): Blocks an IP address or CIDR; optional `--hostname <host>` scopes it to a host and `--notes <text>` adds notes.
  • `system-bypass add <IP-or-CIDR>` (required): Adds an IP/CIDR exempt from system-level mitigations; optional `--domain <domain>` scopes it and `--notes <text>` adds notes.
  • `attack-mode enable --duration <duration>`: Enables attack mode; documented durations are `1h` (default), `6h`, and `24h`.
  • `system-mitigations pause` / `resume` (required): Pauses or resumes automatic system mitigations; pause auto-resumes after 24 hours.
  • Prerequisite: Link the project first with `vercel link`.
  • Prerequisite: System bypass is limited to Pro and Enterprise plans.
  • Prerequisite: Attack mode enable requires interactive confirmation; the CLI documentation says it is blocked for agents/scripts.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card