Legitimate traffic to /korea/* still blocked (403, x-vercel-mitigated: deny) after root cause fixed

Project: koreanwave (koreanwave.io / koreanwave.pe.kr)

Current behavior: Requests to /korea/* on koreanwave.io are being blocked with HTTP 403, header "x-vercel-mitigated: deny". Real browser visitors (not just automated tools) are affected.

Root cause (already fixed): A misconfigured rewrites() rule in next.config.js was causing an infinite redirect loop on koreanwave.pe.kr (www <-> non-www), which inflated Edge Requests to ~4.4M/1M on our Hobby plan over the past ~24 hours. We identified and removed the faulty rewrite rule and redeployed (commit 7d891cc, ~1 hour ago).

Current status:

koreanwave.pe.kr: mitigation has cleared, /korea/* now loads normally.
koreanwave.io: /korea/* is still blocked, escalated from "challenge" to "deny" during our testing.

Expected behavior: Since the root cause (redirect loop) has been fixed and deployed, we'd like the mitigation on koreanwave.io/korea/* to be reviewed/reset, as this is legitimate site traffic, not an attack.

Sample blocked request ID: icn1::tpf58-1786250406718-aaf2b96b3e80

Any help would be appreciated. Thank you!

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

https://vercel.com/docs/domains/troubleshooting

vercel.com

Troubleshooting domains

Learn about common reasons for domain misconfigurations and how to troubleshoot your domain on Vercel.

Update (9h later): Still blocked. Followed up with Vercel Support chat directly — confirmed this cannot be resolved via support chat or case forms. Firewall/Security case categories are paywalled on Hobby plans (case form shows "Visit our Community or create a paid account" when selecting Security > Firewall). Support stated mitigations should "automatically lift once traffic normalizes," but it's been 9+ hours since the root cause was fixed and deployed, with no change on koreanwave.io/korea/*.

Would really appreciate a Vercel team member manually checking/clearing this. Sample blocked request ID: icn1::tpf58-1786250406718-aaf2b96b3e80

Final update: Resolved — and it turned out to be on our side, not Vercel's.

Root cause #2: Our Cloudflare DNS for koreanwave.io's root and www records (CNAME → Vercel) had somehow reverted to "DNS only" (grey cloud) instead of "Proxied" (orange cloud). This meant our Cloudflare Worker — which routes /korea/* to our own origin server — was never executing, so those requests were hitting Vercel directly as unrecognized routes, which is likely what triggered/sustained the mitigation in the first place.

Re-enabling Cloudflare proxy (orange cloud) on both records fixed /korea/* immediately. No manual clearing from Vercel was needed after all — the mitigation appears to have been a symptom of misrouted traffic, not a stuck flag.

Leaving this here in case anyone else on Hobby sees "x-vercel-mitigated: deny" on routes meant to be handled by an external origin behind Cloudflare — check your DNS proxy status first.

This topic is closed. It no longer accepts new replies.