Vercel

Vercel's firewall is where the Vercel Security Checkpoint comes from — the interstitial page that asks the visitor's browser to solve a JavaScript challenge. Testomatobot is not a browser and cannot solve it, so a challenged check always fails. Vercel's documentation says as much: automated tools cannot establish a challenge session, and the supported answer for legitimate automation is a bypass rule.

The checkpoint shows up for three different reasons, and the fix is not the same for all of them:

What is challenging the request	How to let Testomato through
A custom rule with the Challenge action	A custom rule with the Bypass action, ordered above it
Attack Mode, under Firewall → Bot Management	Attack Mode waves through the bots in Vercel's own verified-bot directory, and Testomatobot is not one of them. Disable Attack Mode once the attack is over, or add a System Bypass rule
Automatic DDoS mitigation	A System Bypass rule — see System-level mitigations below

Add a bypass rule

1. In the Vercel dashboard, open your project and select Firewall in the sidebar.
2. Select ⋯ → Configure at the top right, then Add Rule.
3. Name the rule, for example Allow Testomatobot traffic.
4. Add an If condition on IP Address, listing Testomato's addresses, combine it with AND, and add a second condition: User Agent Contains Testomatobot.
5. Set Then to Bypass.
6. Select Save Rule, then Review Changes and Publish.

The rule then appears under Project rules, where you can toggle it off without deleting it:

Caution

The rule pictured above matches on the user agent alone, which is the quickest thing to set up and the weakest — the header is trivial to forge, so anyone who sends it walks straight past your firewall. Add the IP condition and combine the two with AND.

Match on Testomatobot, not on Testomatobot/1.0 or minicrawler/5.2.7. The platform and minicrawler version change between releases, and a rule pinned to one of them stops matching without warning.

Generate the rule with a prompt

Vercel builds a rule from a plain-English description, but it cannot read the address list for you — give it the URL on its own and it says so and asks you to paste the addresses instead. So fetch them first:

curl -fsS https://testomato.com/bot/ipv4-ipv6.txt | paste -sd, -

Use ipv4.txt instead if your site is not reachable over IPv6. Then paste this into the text area at the top of the rule form, with the addresses in place of the placeholder, and select Generate Rule:

Create a rule named "Allow Testomatobot traffic" for Testomato's website monitoring service.

Match a request when the User Agent contains "Testomatobot" AND the IP address is one of:
<paste the addresses here, comma-separated>

Set the action to Bypass.

Caution

When it asks for the addresses, it also offers to build a rule that matches the user agent alone and let you add the IP conditions later. Decline that one. A Bypass rule keyed on a header anyone can send is an open door through your firewall, and "later" tends not to come.

Read the conditions before you save and compare them against the file. A rule whose IP condition came out empty, or holds addresses that are not Testomato's, looks perfectly reasonable in the form and quietly matches nothing — with a bypass action, the only symptom is checks that keep failing.

The same text area edits an existing rule — "add the IP addresses to the condition" or "change the action to bypass" both work.

System-level mitigations

A bypass custom rule only bypasses your remaining custom rules and the managed rulesets. Vercel is explicit that it does not cover system-level mitigations such as DDoS protection. If checks still fail while the rule is live and matching, add a System Bypass rule:

1. On the Firewall page, select Add New and then System Bypass.
2. Fill in IP Address Or CIDR and Domain — a domain connected to the project, or * for all of them — and a note for future reference.
3. Select Create System Bypass, and repeat for each address.

Note

System Bypass rules are a Pro and Enterprise feature, limited to 25 rules per project on Pro and 100 on Enterprise. The twelve IPv4 addresses fit comfortably; add the IPv6 ones only if your site is reachable over IPv6.

Custom rules are capped too — three per project on Hobby, forty on Pro.

Caution

WAF rules defined in vercel.json through routes and mitigate support only the challenge and deny actions. A bypass rule has to be created in the dashboard, the CLI or the REST API. Firewall changes apply immediately and do not need a redeployment.

Tip

Once the rule is published, confirm it worked by checking your logs rather than by waiting for the next check to go green.