If your Vercel bill suddenly jumps to $50, $100, or even $200 a day, the most likely cause is bot traffic hammering your dynamic pages, and the fastest fix is a Vercel Firewall rule that blocks or challenges the regions and user agents responsible. I learned that the hard way: it took me roughly 50 days and several thousand dollars in inflated bills to find a fix that, once I knew what to look for, took about two minutes to apply.
Key takeaway: Bot farms crawling large or programmatic sites can inflate a Vercel bill fast through function invocations, ISR, image optimization, and data transfer. A firewall rule that blocks or challenges the offending regions and user agents is usually the fix. Set spend alerts and firewall rules before you scale, not after.
This is a war story, not a hit piece. I still rate Vercel's developer experience. But I want the next person who sees a billing graph climb for no obvious reason to find this page and skip the 50 days I spent.
What actually happened
My bill started climbing with no matching jump in real visitors. Most days it ran $50 to $100 over baseline, and on the worst days it hit around $200. Averaged across the peak period, I was burning roughly $125 a day. The site is large and mostly programmatic, well into six figures of pages, which turned out to be exactly the profile automated crawlers love: a near-endless supply of unique URLs to hit.
Where the money actually went
Vercel does not bill one big traffic number. It bills a stack of metered line items, and bots inflate several of them at once: function invocations, Incremental Static Regeneration reads and writes, edge requests, fast data transfer, and image optimization transforms. Image optimization was a painful one, because each unique image request a bot triggers can count as a transformation. Multiply that across crawlers hitting more than 100,000 paths and the meter simply never stops.
The lesson that cost me the most: on a large site, the line item that hurts is rarely the one you watch. I was thinking about bandwidth. The damage was in function invocations and image work driven entirely by traffic that was never going to convert, click, or read anything.
Why it took 50 days
Blocking bots is easy. Proving they were the cause was not. The traffic was clearly non-human, and a large share came from bot farms routing through a small number of regions, but Vercel's usage dashboard shows you what is being consumed without always making it obvious why. Correlating a specific billing line to a specific bot pattern took far longer than it should have, and most of those 50 days were spent on attribution, not on the fix itself.
The two-minute fix
Once I understood the pattern, the fix was a Vercel Firewall custom rule: block or challenge requests from the regions and user agents responsible, rate-limit the most aggressive paths, and stop bots from triggering expensive image and ISR work. Writing that rule took about two minutes. My average daily spend dropped from roughly $125 to about $30. Thirty dollars a day is still more than I want, and I am tuning it further, but it is a different universe from where it started.
A fair word on Vercel support
I want to be measured here, because I do not enjoy criticising a product I otherwise like. But support on the Pro plan was slower than I expected for a paid tier. I did get some help from the team, yet no one diagnosed or fixed what turned out to be a small configuration change, and a few replies felt dismissive rather than curious. When a customer is visibly losing money on your platform, support should want to get to the bottom of it. That is the part I hope Vercel improves, because the rest of the product earns the loyalty it asks for.
If you are scaling on Vercel, do this first
Turn on spend management and budget alerts before you grow, not after the first scary invoice. Being told as usage climbs is worth far more than discovering it at month end.
Add Vercel Firewall rules early. Block or challenge by country, IP, user agent, and path, and rate-limit routes that bots love. Robots.txt will not stop crawlers that ignore it.
Know which line items scale with traffic. Image optimization, function invocations, ISR reads and writes, and fast data transfer all move with volume, and bots move all of them at once.
Watch image optimization especially on image-heavy or programmatic sites. It is the cost that surprised me most. Consider serving pre-optimized images from storage or a CDN rather than transforming on the metered path.
So, is Vercel still worth it?
Yes, with your eyes open. For small and mid-size projects the developer experience is still the best in the business, and I keep using it. But if you are running tens of thousands of visits or 100,000-plus pages, treat billing as a first-class engineering concern from day one. The platform will let you spend a lot of money very quickly if you do not put guardrails up yourself.
FAQ
Why did my Vercel bill suddenly spike?
The most common cause is non-human traffic, such as bots, scrapers, or bot farms, crawling your dynamic or programmatic pages and inflating metered line items like function invocations, ISR, fast data transfer, and image optimization. A spike with no matching rise in real users is the giveaway.
How do I block bot traffic on Vercel?
Use the Vercel Firewall to block or challenge requests by country, IP, user agent, or path, and add rate limiting on aggressive routes. For heavier protection, front your app with a dedicated WAF. Robots.txt alone will not stop bots that choose to ignore it.
Does Vercel stop bots and DDoS automatically?
Vercel includes baseline DDoS mitigation and some bot controls, but it does not automatically stop the distributed crawling that quietly inflates bills. You generally need to configure firewall rules yourself to protect your spend.
How do I cap or control Vercel spending?
Enable spend management with budget alerts so you are notified as usage rises, and review the usage dashboard regularly. On supported plans it can take action such as pausing a project at a threshold, which beats finding a spike after the fact.
Related: Vercel alternatives if the bill pushes you to weigh other hosts, and Cloudflare alternatives for the WAF and bot-management layer.