Restricting API calls to my own Next.js project to prevent spam

[benoitded]

Hey everyone,

I have a Next.js project hosted on Vercel, and I’m running into a big issue: people are scraping my API endpoints and spamming them, causing huge Function Duration usage. As a result, I’m facing a massive bill due to traffic from non-legitimate users.

I’d like to set things up so that these endpoints can only be called from my own website/project and not be publicly accessible to anyone. Is there a recommended way—either via Next.js configuration or Vercel settings—to ensure only my site can call these APIs?

I’d really appreciate any guidance or best practices. This month, my bill skyrocketed to $1000, whereas I usually pay around $40. If someone from the Vercel team can also jump in to help, that would be amazing. I can’t afford these unexpected charges caused by spam traffic.

Thanks in advance for your help!

[swarnava (Swarnava Sengupta)]

Hi, @littatech!

@earlrobb shared this very helpful post recently, he created rules that target these URLs specifically.

Vercel Firewall rules to deny bot attacks

Have a small hobby Next.js 14 site. Sorting data I found 40,000 monthly 404’s in the vercel Usage tab. Looking at the Top Paths it’s obvious the site is being hit by bots trying to attack php files and wordpress directories. I have neither on the site. I am new to firewall management and was wondering if I could get some tips or improvements on what I have done? In Firewall Rules I have created 2 rules. RequestPath → MatchesExpression → .php$|.php7$|.aspx$ RequestPath → MatchesExpression ->(…

I’ll also share some other potentially helpful content related to the Firewall:

How to analyze and control traffic on Vercel

Nobody wants to serve traffic to malicious or abusive users - this is pretty much universally true. The problem is that detecting those users and blocking them isn’t easy, and if you want to avoid blocking legitimate traffic, it gets even harder. If you run a public-facing site or app on Vercel, you have probably spent some time thinking about how to control its traffic. Like with most problems, the first step to solving it is analysis, so that’s what I’ll discuss in this guide. Solution The…

Enterprise Experience Group: Vercel Firewall

Hi, Vercel Community! I’m Malavika, a Product Manager at Vercel. We recently hosted a Customer Enterprise Experience Group session on on the Vercel Firewall. During this session, we discussed recently released Firewall features, did a deep dive on how to use rate limiting, and answered questions from the audience. Chect out the recording ↓ [Enterprise Experience Group: Vercel Firewall] If you have any questions, let us know!

Usage Optimization, Spend Management, and Security Best Practices for Vercel Pro

Thank you to everyone who joined the “Usage Optimization, Spend Management, and Security Best Practices” session! During the session, you: Learned how to optimize your team’s infrastructure spend Discovered Vercel’s out-of-the-box features to keep your site secure We encourage you to use this space for any follow-up questions, discussions and connect with others you met on the call. What insights or strategies are you excited to implement from today’s session? Feel free to share your thought…

How can I configure Vercel WAF on my app? Seeing several suspicious logs

Hi to all, Everyday when I see error logs I find these logs [Screenshot 2024-09-16 at 17.47.01] [Screenshot 2024-09-16 at 17.47.11] can someone tell me how to stop this we are not using PHP website or Wordpress we have Next Js app

Let us know how you have any other specific questions!

[benoitded]

Thank you for your reply!
I’ll read everything

I quickly tried to enable vercel WAF, but having this “We’re verifying your browser” everytime someone visit my website is not possible.
Do you know if it’s possible to only enable it for the API? (so it’s hidden and users don’t even know there is a verification?

[swarnava (Swarnava Sengupta)]

Hello,

You can configure custom rules in your Vercel Firewall to enable Challenge for specific request path: WAF Custom Rules

[benoitded]

So should I add a rule like that?

I don’t get everything on WAF Custom rules