Vercel cuts firewall-mitigated request charges to $0 for denied, challenged, and rate-limited traffic

• Vercel's announcement says requests denied, challenged, or rate-limited by Vercel Firewall now cost $0.
• According to Guillermo Rauch's post, the change covers not just DDoS and system mitigations, but also any custom firewall rule teams configure.
• Malte Ubl's clarification says the old setup mixed billed and unbilled mitigations depending on which rule fired, and that distinction is now gone.
• Vercel's CLI post shipped a vercel firewall command a day earlier, giving the new pricing change a matching terminal control surface for custom rules, IP blocks, system mitigations, and Attack Mode.

You can read the official billing change note, and the rollout sits next to a fresh CLI firewall command. Rauch framed it as Vercel absorbing the compute and network cost of mitigated traffic, while Malte Ubl's post makes the practical part clearer: custom-rule traffic used to be the messy case, and now it is free too.

The change is simple and unusually clean: if Vercel Firewall blocks the request, challenges it, or rate-limits it, that request no longer shows up as billable traffic. The official changelog says the policy now covers all firewall-mitigated traffic, extending free mitigation beyond earlier DDoS handling to user-configured rules too via the official changelog.

Rauch says Vercel is absorbing the computational and network costs of attacks or other traffic caught by those mitigations. That turns a pricing edge case into a straightforward rule: rejected traffic is free, even when the rejecting rule is one you wrote yourself.

According to Malte Ubl's clarification, Vercel previously had a mixed model where billing depended on the type of firewall rule that triggered. That detail matters because it explains what actually changed here: this is not just broader DDoS protection, it is a removal of the custom-rule billing carveout.

In practice, the announcement closes the awkward case where tightening a custom rule could also mean paying for the traffic it discarded. The new policy removes that distinction for denied, challenged, and rate-limited requests.

A day before the pricing update, Vercel shipped a vercel firewall command in the CLI through the CLI changelog. The post says the command covers:

• custom rules
• IP blocks
• system mitigations
• Attack Mode

The timing makes the story more concrete than a pricing tweak alone. Vercel changed both the economics of mitigated traffic and the place where teams, or their agents, can configure the firewall from the terminal.