Is there really no way to only have one production domain on Vercel?

Feedback
1

From Is there really no way to only have one production domain on Vercel? · Issue #13090 · vercel/vercel · GitHub

Hi!

I love the generated preview domains that need authentication to be accessed, but it just hit me that (git connected) production deploys with a custom domain always will have at least 3 domains connected to it.

I’m talking about production deploys. Lets say I have a team named foo and a project called bar. I’ve assigned the custom domain bar.com and deleted bar.vercel.app from domains. So far so good.

My bar-app is deployed to production when I merge into main. After the merge my site is now available world-wide on 3 domains:

  • bar.com (set up by me)
  • bar-foo.vercel.app (auto generated by Vercel)
  • bar-git-main-foo.vercel.app (auto generated by Vercel)

I have enabled “Standard Protection (recommended)”, but this does not restrict access to the auto generated domains.

There are some reasons why I feel this is bad:

  • Content should not be duplicated on different domains (both for SEO and privacy/control).
  • Search results and indexing. I don’t want my content to be indexed on other domains and show up in the search results.
  • DDoS protection or other configs can be bypassed by using the vercel domains (e.g. if I have Cloudflare in front of bar.com)
  • Having more domains available for the same content puts more responsibility on the developer and SEO in general. E.g. setting correct canonical URLs no matter what domain the user visits from, disable robots if it’s an vercel.app url, ++.
  • Surprising behaviour. Even though I’ve added my custom domain and removed the vercel.app domain from domains my site is still available for all on domains I have not set up.
  • Less control of domains / still available content on Vercel domains after my site or domain is deleted.

I also find the docs a bit misleading:

  • If I manually re-deploy the site I see the following message:

    Image
    Image590×636 33.7 KB

    But it will actually be available on two more domains.

  • If I go to Settings → Deployment Protection and hover “Standard Protection (recommended)” it says that all 3 domains will be available (true):

    Image
    Image931×395 39.6 KB

but if f I enable “Standard Protection (recommended)” and click the “Migrating to Standard Protection” link the docs tell me the following (not true?):

Image
Image646×127 11.4 KB

Image
Image745×1152 141 KB

Is this the expected behaviour? Am I misinterpreting the docs?
I assume there is a good reason behind having the domains public for all, but it would be nice if the Vercel team could elaborate on this.

For now I guess a fix could be to redirect or password protect the site with a middlware if the site is visited from an auto generated domain. But to be fair I don’t think this is the developers responsibility to deal with.

I found some other issues / questions regarding the same topic:

3

Welcome to the community, @nettum. I’ll pass this feedback along to the team, but I also want to give you a few things you can do immediately to address your concerns.

Standard Protection will prevent access via the unique deployment URL, but will still allow access via any up-to-date Production domains. This means bar.com, bar-foo.vercel.app, and bar-git-main-foo.vercel.app would all be publicly accessible, but bar-4lekbjle1-foo.vercel.app would only be accessible to you. Because the other production domains are predictable, there are a few ways that you can get additional control.

You can use WAF Custom Rules to block or redirect traffic for the hostnames you don’t want people using.

image
image975×739 31.1 KB

There are a lot of other ways the Vercel Firewall can protect your site too. I recommend reading more about those options in the docs: Vercel Firewall

It’s a good idea to set a canonical link on most sites for SEO control. That will signal to search engines that the other domains are duplicates so indexing can be skipped. Since the domains all lead to the same site, you only have to set this up once for the project.

5 Likes
4

Hi @amyegan! Thank you for passing the feedback along to the team.
Didn’t think of using the firewall to do the redirects, but that’s certainly a way to solve it.

3 Likes
5

We have future updates planned for this feature, but the team confirmed that the firewall solution is the best option for right now.

1 Like
6

Wow, firewall sounds like a really simple solution, compared to what I have in place — authentication with Clerk that allows only my custom domain.

2 Likes
7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.