Skip to main content
UNPWNED
Scan free
Back to Home

Let UNPWNED Scan Your Vercel Site

Vercel's firewall challenges traffic it does not recognise, and a security scanner sending many requests in a short window is exactly what it watches for. When that happens the report says which checks Vercel turned away. Those checks stay unknown, not clean, and they never deduct points.

The short version

First: verify ownership in Domains with a TXT, HTML file, or meta tag. When a report says Vercel turned checks away, add one System Bypass rule in your Vercel project: the UNPWNED scanner IP, for that exact hostname. It needs no token and no connection, Vercel offers it on Pro and Enterprise teams, and it costs nothing on any UNPWNED plan. Then start the next scan yourself: a scan you start re-tries the dedicated scanner address at once, while scheduled monitoring waits for that scan to prove the rule works.

Add the System Bypass rule

  1. Copy the UNPWNED scanner IP from scanning-ips.json. It is one dedicated address, published there and nowhere else. If the file lists no address, UNPWNED's dedicated scanner egress is paused and there is nothing to allow yet; check back before adding a rule.
  2. In the Vercel dashboard open the project that serves your site, then Firewall, press Add New and choose System Bypass.
  3. Enter the scanner IP as the address, your exact hostname as the domain, and a note you will recognise later, such as UNPWNED scanner. Save it. System Bypass rules take effect at once; nothing needs publishing.
  4. Back in UNPWNED, open Domains and start the next scan. The report shows whether Vercel still turned any check away.
Open VercelOpen Domains

What the rule does, and does not do

  • It is one System Bypass entry in your project's Firewall tab: the UNPWNED scanner IP, for the exact hostname you verified. Vercel stops applying its system-level mitigations, such as its DDoS protection, to that address on that hostname.
  • It does not touch your own WAF custom rules. If you deny or challenge the scanner there, that rule still wins; Vercel documents a custom rule with a bypass action for that case.
  • It allows no other address and no other hostname. The UNPWNED scanner IP is published at scanning-ips.json, linked from the scanning policy.
  • Vercel offers System Bypass rules on Pro and Enterprise teams, up to ten per project on Pro. On a Hobby team there is no rule to add, and owner scans of the site may keep being challenged. Your UNPWNED plan makes no difference: the rule lives in Vercel, and it is yours.

Why UNPWNED does not add it for you

A Vercel access token cannot be limited to one permission: even a token scoped to a single project reaches that project's deployments and settings, far more than a firewall rule needs. UNPWNED does not ask for one, and it never creates, reads or manages rules in your Vercel project. The rule stays yours, in your dashboard, and you remove it there whenever you want.

Vercel docs: System Bypass Rules

Removing it

Delete the System Bypass entry in your project's Firewall tab. The next scan of this site may then be challenged again and cover less, and the report will say so.