Our production domain suddenly started returning HTTP 403.
Response header:
x-vercel-mitigated: deny
The alias domains point to the exact same Production deployment and work normally.
We believe this is a false positive caused by Vercel Edge mitigation and would appreciate someone from the Vercel team reviewing and removing the mitigation.
Current behavior
Our production domain:
suddenly started returning:
HTTP 403 Forbidden
with the response header:
x-vercel-mitigated: deny
However, both alias domains point to the exact same Production deployment and work normally:
Expected behavior
The production domain should behave exactly the same as the alias domains and return HTTP 200.
Already verified:
- Latest Production deployment is Ready.
- Production Alias is correctly assigned.
- No Deployment Protection.
- No Password Protection.
- No SSO Protection.
- No Trusted IPs configured.
- No Custom Firewall Rules.
- Bot Protection is disabled.
- Firewall dashboard shows no active custom rules.
- The application works correctly through the alias domains.
- The issue affects desktop browsers and mobile devices.
Steps to reproduce:
- Open:
https://jibulong-mingli.vercel.app
Result:
HTTP 403 Forbidden
Response header:
x-vercel-mitigated: deny - Open:
https://jibulong-mingli-yijing.vercel.app
Result:
HTTP 200
The application loads correctly.
Project name:
jibulong-mingli
Framework:
Next.js (App Router)
Hosting:
Vercel Production
Environment:
Production
Production domain:
Working alias domains:
Deployment status:
Ready
Issue started:
The production domain worked normally before and suddenly began returning HTTP 403.
Additional information:
Only the primary production domain is blocked.
The alias domains point to the exact same deployment and continue to work normally.
This appears to be a false positive triggered by Vercel Edge mitigation.