Vendor, ranked 6 (tied) of 15
Vercel
In short
Vercel's BotID and firewall verify agents and apply per-purpose policy and reporting, grading yes on all three, for 6 of 10 points. Basic BotID is free, commerce agents are not published, and the docs read describe no means of charging AI crawlers.
Hosting platform with an invisible CAPTCHA (BotID, Deep Analysis by Kasada), a verified bot directory checked by IP, reverse DNS and Web Bot Auth, and a firewall ruleset that treats AI crawlers and AI assistants separately.
Alternatives to Vercel ยท vercel.com
- Type
- Bot management
- Homepage
- vercel.com
- Last read
- 2026-11-05
The rubric, with evidence
| Question | Grade | What the vendor documents |
|---|---|---|
| Tells a verified agent from a spoof | Yes | IP, reverse DNS and Web Bot Auth; directory at bots.fyi |
| Per-purpose policy (train, search, answer, act) | Yes | AI crawlers and AI assistants handled separately since 2026-10-29 |
| Charging for access | Not published | support (checked 2026-11-04) |
| Lets signed commerce agents through | Not published | Visa TAP or Mastercard Agent Pay support (checked 2026-11-04) |
| Cost | published: Basic free; Deep Analysis USD 1 per 1,000 checks on Pro | |
| Reporting | Yes | Firewall tab BotID filter and Observability Plus metrics |
| Where it runs | both: managed rulesets at Vercel's edge firewall; BotID verdict read in server code via checkBotId() |
Cost
BotID Basic free on all plans; Deep Analysis USD 1 per 1,000 checkBotId() calls on Pro, custom on Enterprise; AI Bots managed ruleset on all plans. Source, read 2026-11-04.
What Vercel does not do
- No charging or pay-per-crawl for AI crawlers (BotID and firewall docs read 2026-11-04).
- BotID Deep Analysis is not on the Hobby plan; it is listed for Pro and Enterprise only (BotID pricing table).
- BotID does not inspect passive page views; it only runs where the app calls checkBotId() (BotID docs).
- Vercel's Bot Protection is not meant to run behind another CDN or reverse proxy; Vercel says detection degrades in that setup.
Documented facts
- Primary source BotID is an invisible client-side challenge for high-value routes such as checkout, signup and APIs, available on all plans. Source, read 2026-11-04, dated 2026-06-16.
- Primary source BotID Basic is free on all plans; Deep Analysis costs USD 1 per 1,000 checkBotId() calls on Pro and is custom-priced on Enterprise. Source, read 2026-11-04, dated 2026-06-16.
- Primary source Only calls to checkBotId() are charged; passive page views are not. Source, read 2026-11-04, dated 2026-06-16.
- Primary source BotID Deep Analysis is powered by Kasada. Source, read 2026-11-04, dated 2026-06-16.
- Primary source Vercel verifies known bots by IP, reverse DNS and Web Bot Auth, so signed bots pass Bot Protection and Challenge Mode; ChatGPT's operator agent was the cited example. Source, read 2026-11-04, dated 2025-08-12.
- Primary source checkBotId() returns isVerifiedBot, verifiedBotName and verifiedBotCategory, which requires botid 1.5.0 or later. Source, read 2026-11-04, dated 2026-02-26.
- Primary source Vercel publishes its directory of known and verified bots at bots.fyi. Source, read 2026-11-04, dated 2026-02-26.
- Primary source Since 29 Oct 2026 the AI Bots managed ruleset can log or block AI crawlers (indexing and training) and AI assistants (user-triggered fetches) separately, on all plans. Source, read 2026-11-04, dated 2026-10-29.
- Primary source BotID checks show in the project Firewall tab traffic filter, with metrics in Observability Plus. Source, read 2026-11-04, dated 2026-06-16.
Dated news
- 2026-10-29Vercel splits AI crawlers and AI assistants in its AI Bots ruleset. Vercel's AI Bots managed ruleset can now log or block AI crawlers, which collect content for indexing and training, separately from AI assistants, which fetch pages for a user or search query. Vercel keeps the lists current and the ruleset is on all plans. Source.
Compared with
- Arcjet vs Vercel: Arcjet verifies known bots by IP and reverse DNS inside application code through its SDK; Vercel verifies by IP, reverse DNS and Web Bot Auth at its edge and splits AI crawlers from AI assistants in a managed ruleset since 2026-10-29.
- Cloudflare vs Vercel: Cloudflare publishes a no-training preference into robots.txt with Disallow AI Training (2026-09-15); Vercel's AI Bots ruleset logs or blocks AI crawlers and AI assistants separately (2026-10-29) without writing robots.txt.
- Vercel vs Netlify: Vercel verifies bots by IP, reverse DNS and Web Bot Auth; Netlify's AI bot control is a User Agent Blocker extension that matches strings only and can be active on one project at a time.
- Kasada vs Vercel: Kasada powers Vercel BotID Deep Analysis, sold by Vercel at USD 1 per 1,000 checkBotId() calls on Pro; Kasada itself is sales-led and adds an AI agent directory and edge policies.
- Vercel vs AWS WAF Bot Control: Vercel splits AI crawlers from AI assistants on all plans for free; AWS WAF labels bots by category and name and can charge them, at USD 10 a month per web ACL plus request fees.
What Vercel does for this layer
From the vendor's own pages
Vercel's bot management docs say Bot Protection does not work when a reverse proxy such as Cloudflare or Azure sits in front of a Vercel deployment, because the proxy masks detection signals. (vercel.com) Vercel's bot protection managed ruleset, on all plans, serves a JavaScript challenge to clients that break browser-like behavior. (vercel.com) Vercel's docs give the reverse DNS example that an IP claiming to be Googlebot should resolve to *.googlebot.com or *.google.com. (vercel.com)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| AI Bots managed ruleset | Log or block AI crawlers and AI assistants separately in Vercel Firewall. | included | USD 0 | 2026-11-05 |
| BotID | Invisible client-side challenge for routes such as checkout, signup and APIs. | per call | 1 per 1,000 checkBotId() calls (Deep Analysis, Pro) | 2026-11-05 |
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | Supports | Vercel lists Web Bot Authentication with HTTP Message Signatures among its verification methods. (vercel.com) |
| Published IP list | Supports | Vercel checks requests against known IP ranges of bot operators. (vercel.com) |
| Reverse DNS check | Supports | Vercel performs reverse DNS lookups on claimed bots. (vercel.com) |
| Visa Trusted Agent Protocol | No statement | No statement in the Vercel docs read 2026-11-05. |
| Mastercard Agent Pay | No statement | No statement in the Vercel docs read 2026-11-05. |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
Related pages on this site
Sources
Last reviewed 2026-11-05