Key differences: Vercel WAF vs Arcjet
Teams looking for a Vercel WAF alternative want Shield, bots, rate limiting, filters, email validation, and identity-keyed rules inside the application, on any host, not only on Vercel.
Vercel WAF runs at the network and CDN edge. Rules evaluate before a request reaches your application. Arcjet runs inside your application request handlers. Network-layer rules act on a fixed set of signals: IP, user agent, TLS fingerprint, URL path, and headers. In-app rules have the request context that your application already has (session, subscription, feature flags, route) and can key a limit on a user, account, or plan.
What each layer covers
Vercel WAF is the right tool for platform DDoS and coarse edge filtering on Vercel. Arcjet is an in-app security platform: Shield WAF, known-bot classification with optional advanced client signals, rate limits keyed on any computed value, filters in code, and email validation. Operational HTTP remote rules change in the Arcjet dashboard or through MCP and take effect immediately, still inside the application. Those rules cover a country, ASN, IP, or VPN block; a global bot category; a filter; a temporary site-wide fixed-window or sliding-window rate limit; and Shield WAF.
App-specific rules stay in code because they need application context: per-user token budgets, prompt injection, personally identifiable information (PII), email validation, and identity-keyed limits. You set token-bucket budgets in application code because each call declares how many tokens it consumes. Arcjet can also run prompt-injection, token-spend, and sensitive-information checks on tool calls and jobs. Bot detection is an HTTP control in request handlers.
Configuration
Vercel WAF changes rules in the Vercel dashboard at the CDN edge. A limited vercel.json path supports only challenge and deny; logging, bypass, and redirect are dashboard-only, and there's no per-request dynamic logic.
Platform independence
Arcjet works wherever you can run a JavaScript, TypeScript, or Python application. Go is pre-release. Vercel WAF applies only to applications hosted on Vercel.
Bot detection
Vercel's Bot Protection managed ruleset identifies clients that violate browser-like behavior and serves a JavaScript challenge. It's available on all plans. Vercel's documentation warns that it doesn't work correctly behind a reverse proxy (Cloudflare, Azure CDN, and similar): the proxy masks detection signals. Arcjet classifies known bots by name and category in your request handlers and can add browser-based signals. It runs inside the application, so a reverse proxy in front of the origin doesn't break it.
Rate limiting
Vercel WAF rate limiting is request-count based. On Hobby and Pro, counting keys are IP and JA4 Digest; User Agent and arbitrary header keys are Enterprise-only. Token Bucket is Enterprise-only. Maximum window is 10 minutes on Hobby and Pro, 1 hour on Enterprise. Rules per project: 1 on Hobby, 40 on Pro, 1,000 on Enterprise. You configure Arcjet rate limiting in code. It can key on any value that the application can compute, and it supports token-bucket budgets on self-serve plans as values set in the SDK.
Plan gating
OWASP Core Ruleset, token-bucket rate limiting, and non-IP/non-JA4 rate-limit keys are Vercel Enterprise. Bot Protection and AI Bots managed rulesets are on all plans. Arcjet Shield WAF, bot detection, advanced signals, filters, and identity-keyed rate limits are available on self-serve plans.
Comparison
| Area | Arcjet | Vercel WAF |
|---|---|---|
| Where it runs | Inside your application request handlers, with the session, plan, and route context that the edge doesn't have. | At the network/CDN edge, before requests reach your application. |
| Configuration | Operational HTTP rules change in the Arcjet dashboard or through MCP and take effect immediately, still inside the app. App-specific rules stay in code: identity-keyed limits, email, PII, and prompt injection. You set token-bucket budgets in application code. | Dashboard UI (publish without redeployment). Limited
|
| Hosting | Works on any provider, or self-hosted. | Vercel only. |
| Languages | JavaScript, TypeScript, and Python. Go is pre-release. | Any language hosted on Vercel. WAF rules apply at the network layer. |
| Bot detection | Known bots by name and category in request handlers, with optional advanced client signals. Works behind any proxy or CDN. | Bot Protection managed ruleset (all plans) uses a JavaScript challenge. Vercel documents it as broken behind reverse proxies. |
| WAF / attack coverage | Shield WAF in request handlers (self-serve). | OWASP Core Ruleset (Enterprise-only). Platform-level DDoS (L3/L4/L7) is automatic and free on all plans. |
| Rate limiting | Key on user ID, account, session, plan, or any computed value. Token-bucket budgets on all plans, set in code. | Hobby/Pro: IP or JA4 Digest only. Token bucket and arbitrary header keys: Enterprise. Max window 10 min (Hobby/Pro), 1 hour (Enterprise). Rules: 1 / 40 / 1,000. |
| Filter rules | Filters in code that combine cookie, IP reputation, geo, VPN/proxy, header, and path with bot and rate-limit rules. | Custom rules in the dashboard, including log, on all plans. No runtime branching on app context. |
| Email / identity | Email validation and identity-keyed rules in the same product. | Network identifiers only. No concept of authenticated users. |
| AI bot blocking | AI crawler category on HTTP bot rules. | AI Bots managed ruleset (all plans). Log or Deny only. Content scraping, not application logic. |
| Agentic / non-HTTP | Token spend, prompt injection, and sensitive-info on tool and job inputs. Bot detection is an HTTP control in request handlers. | The WAF inspects HTTP at the edge. Tool calls, queued jobs, and fan-out work sit inside the application. |
| Local development | Same behavior as production. | WAF rules don't apply locally; |
In-app security vs the edge
Vercel WAF is an inbound HTTP control. That's the right tool for edge filtering and platform DDoS. Arcjet is the application layer: Shield, bots, rate limits, filters, and email in your request handlers, with the identity and route context that the edge doesn't have.
When a security check can't finish (a timeout, a transport issue, or an incomplete policy), you choose what happens next. A direct Guard call returns allow with error codes rather than treating the incomplete check as a denial. Vercel AI SDK and LangChain wrappers fail closed unless you opt into continuing on error. HTTP request checks can fail open when your application can't reach Arcjet's cloud; that behavior is configurable.
In the product, those two surfaces are named protect() (HTTP request handlers) and guard() (tool calls and jobs). Arcjet can also run token-spend budgets, prompt-injection detection, and sensitive-info detection on tool handlers and jobs. You configure prompt-injection detection in code, and the Arcjet Cloud API evaluates the prompt text. Sensitive-info detection runs in your application, with a built-in local engine plus an optional on-device ML model for names, addresses, and government or financial identifiers. Bot detection stays on HTTP request handlers.
A buyer question for any runtime control: can you reconstruct the sequence of actions in a run? Arcjet tags related decisions with a correlation ID so that the run is reconstructable for investigation.
Vercel's AI Bots ruleset blocks crawlers that scrape your content. That's inbound bot management, not application logic. Arcjet bot detection covers inbound HTTP clients in request handlers.
When to choose which
Choose Arcjet
Choose Arcjet if any of the following apply:
- You want a Vercel WAF alternative with rules in application code.
- You need per-user or account-level logic.
- You deploy outside Vercel, or might do so later.
- You sit behind a CDN that breaks Vercel Bot Protection.
- You want Shield WAF, bots, and identity-keyed rate limits without Enterprise pricing.
Choose Vercel WAF
Choose Vercel WAF if any of the following apply:
- You want zero-code infrastructure protection on Vercel.
- You need L3/L4/L7 DDoS mitigation (automatic and free on all plans).
- You need JA4 Digest as a rule condition.
They can run together. Vercel's DDoS mitigation stays on. Use the WAF for coarse network-layer filtering and Arcjet for application-aware rules.
Compare: Cloudflare vs Arcjet · Vercel BotID vs Arcjet · All comparisons
Frequently asked questions
Can I use Arcjet and Vercel WAF at the same time?
Yes. Vercel WAF and Arcjet are complementary layers. Vercel’s automatic DDoS mitigation is always on and free. You can use the WAF for coarse network-layer filtering while using Arcjet for per-user rate limits, bot detection with request context, and checks on agent tool calls and jobs. Arcjet rules run after the request passes through the Vercel network layer.
Does changing an Arcjet rule require a deploy?
Not for operational, site-wide HTTP rules. Those change in the Arcjet dashboard or via MCP and take effect immediately: country, ASN, IP, or VPN blocks; a global bot category; a filter; a temporary fixed-window or sliding-window rate limit; Shield WAF. They still enforce inside the application. App-specific rules stay in code: identity-keyed limits, email, PII, and prompt injection. Token-bucket budgets are set in application code. Labeled tool-call policies are a separate system: a security team can change the policy for a labeled action without changing the tool.
Does Vercel WAF protect my AI application?
Vercel’s AI Bots managed ruleset blocks AI crawlers from scraping your content. That is inbound bot management, not application logic. Arcjet bot detection in request handlers covers inbound HTTP clients. Arcjet can also run prompt-injection detection, per-user token budgets, and sensitive-info checks on tool calls and jobs.
What about my agent’s tool calls, queue workers, and pipelines?
Vercel WAF only sees inbound HTTP at the edge. Tool calls, queued jobs, and fan-out work inside the application sit past that edge. Arcjet can run token-spend budgets, prompt-injection detection, and in-process sensitive-info at those points. Bot detection is an HTTP control in request handlers. When a check cannot finish, a direct Guard call returns allow with error codes. Vercel AI SDK and LangChain wrappers fail closed unless you opt into continuing on error. HTTP request checks can fail open when Arcjet's cloud cannot be reached; that is configurable. If you cannot accept a check that did not finish, look at the error codes. A correlation ID ties Arcjet decisions to a run so the sequence is reconstructable for investigation.
Does Vercel WAF work in local development?
No. Vercel WAF rules only apply to traffic routed through the Vercel network. vercel dev bypasses the WAF. Arcjet runs inside your application and behaves the same locally as in production.
Does Vercel WAF support per-user rate limiting?
Not natively. Vercel WAF keys on network-level identifiers: IP, JA4, user agent, or a specific header. User Agent and arbitrary header keys are Enterprise-only. There is no concept of authenticated users or plan tiers in WAF rules. Arcjet rate limiting is configured in code and can key on any computed value. Token-bucket budgets stay in SDK configuration.
What happens if I am behind Cloudflare or another CDN?
Vercel’s Bot Protection managed ruleset is documented as not working correctly behind reverse proxies such as Cloudflare or Azure CDN. The proxy masks detection signals. Arcjet bot detection runs inside the application and does not depend on those network-layer signals.
In-app security on any host
Get Shield, bots, and rate limits in the app
Identity-keyed rules, email validation, and filters in your request handlers. Works on Vercel or any other host.