Bots and Activity Log

Rate limiting handles too many requests. It doesn't handle the question of whether those requests should be happening at all. A user-agent that says "Mozilla/5.0" tells you nothing about whether there's a human behind it. Bot Protection watches the request fingerprints (patterns, headers, JS behavior) and labels each visit either human or automated.

We're not going to block bots yet. That's a decision that can backfire if Saturday turns out to depend on a feed scraper you forgot about, or a partner integration that looks like a bot because, technically, it is one. Log mode is enough for now. Turn it on, let it watch for a week, then decide.

While we're in security mode, we'll also look at the Activity Log. It's the chronological record of who did what on the team. Most weeks it's boring. The week it isn't, you'll be glad you know where to find it.

Outcome

Bot Protection is enabled in log-only mode on Saturday, and you've audited the team's Activity Log for the last 30 days.

Hands-on exercise 2.4

Two short things. Both live in the dashboard.

Requirements:

1. Open Saturday > Firewall > Rules and find the Bot Management section
2. Set Bot Protection to Log, not Challenge. We want to see the data first, not interrogate anybody yet
3. Set the AI Bots ruleset to Log as well. This catches scrapers training models, which is a different population than sneaker bots but worth knowing about
4. Click Review Changes and Publish. Like custom rules, ruleset changes don't run until published
5. Wait at least 5 minutes, then open Saturday's Firewall page and look at the traffic overview for the first detections
6. Open your team dashboard's Activity page and scan the last 30 days
7. Note anything you don't recognize: a user removal you didn't authorize, a domain disconnection, a settings change at an odd hour

Implementation hints:

• Log mode gives you telemetry without risk. A common pattern is to leave it on for a week or two, look at what got flagged, then flip Bot Protection to Challenge (or the AI Bots ruleset to Deny) once you trust the data.
• Detection combines signature checks on the request (a curl identifying as Chrome gives itself away), behavioral analysis, and browser verification. The user-agent header alone proves nothing; it's trivially spoofable. The JavaScript challenge only enters the picture in Challenge mode. In Log mode Vercel is classifying, not testing.
• If Bot Protection flags traffic you actually want, say, a partner's product feed crawler, you can allow that source explicitly via a custom rule that takes precedence over the managed ruleset. Verified bots like Googlebot are excluded automatically, so search indexing was never at risk.
• The Activity Log is per-team, not per-project. So if you maintain multiple Vercel teams, this is a per-team chore.

Try It

Once you've left Bot Protection in Log mode for a few minutes, open Saturday's Firewall page. The traffic overview breaks requests down by category. Even on a quiet site, you'll see something like:

Last 24 hours
─────────────────────────────────
Requests           1,247
  Allowed          1,182
  Bots (logged)       47
  AI Bots (logged)    18
  Challenged           0
  Blocked              0

The "Bots" and "AI Bots" rows are the new ones. These would have been silently allowed before. Now you can see them. The next time you have a usage spike that you can't explain, this is where you check first.

For the Activity Log, expect something like:

2026-05-26  eve@saturday.example   Created environment variable DROP_WEBHOOK_SECRET
2026-05-26  eve@saturday.example   Deleted environment variable DROP_WEBHOOK_SECRET
2026-05-26  eve@saturday.example   Created environment variable DROP_WEBHOOK_SECRET (sensitive)
2026-05-26  eve@saturday.example   Enabled Vercel Authentication on saturday
2026-05-26  eve@saturday.example   Added firewall rule rate-limit-stock-check on saturday
2026-05-27  eve@saturday.example   Enabled Bot Protection on saturday

If you see entries here that you didn't do, that's a conversation. Vercel exposes richer audit metadata on Enterprise plans through Audit Logs, which we'll cover in Lesson 6.2.

Done-When

• Bot Protection is set to Log on Saturday, and the change is published
• The AI Bots ruleset is set to Log on Saturday
• You've waited at least 5 minutes and seen the first bot detections on Saturday's Firewall page
• You've scrolled through the team's Activity page and recognized every action in the last 30 days

Troubleshooting

The Firewall page shows nothing.

If Saturday genuinely has zero traffic, there's nothing to label. Open the homepage from a couple of devices, including a mobile browser, and check again in a few minutes. Some bot detection runs on second-request signals (cookies, fingerprints), so a single page load might not produce a labeled row.

The Activity Log shows actions from "system" or "Vercel."

That's expected. Vercel logs platform-side events (auto-pause, deployment cleanup, etc.) under a system actor. Skim past them; the entries you're auditing are the human ones.

Solution

The two states you produced:

Saturday > Firewall > Rules > Bot Management
  Bot Protection:  Log
  AI Bots:         Log

Team dashboard > Activity
  Last 30 days: all entries reviewed and recognized

You now have eyes on the two things you most want eyes on for a small team: who's hitting your site (Bot Protection) and who's changing your account (Activity Log).

That wraps Section 2. The next section moves from access to cost. We start with the single most impactful toggle on the platform: Fluid Compute.