Hello Vercel Community,
We are experiencing a reproducible issue where Vercel's automated security mitigation returns HTTP 403 instead of our configured HTTP 404 for unmapped legacy PHP URLs.
Environment
- Plan: Hobby
- Project:
boesendorfer-dip - Production domain:
www.boesendorfer.com.tw - Production deployment:
dpl_7BKuzVCGNqLMm7x1A1DWsD2vrw4p
Problem
Our website previously used PHP-based article URLs. We have migrated to a new website and configured explicit routing rules to return HTTP 404 for unmapped legacy URLs.
However, the following production-domain requests return HTTP 403:
/news/portal_b1_page.php?cnt_id=19005/news/portal_b1_page.php?cnt_id=19559/news/portal_b1.php/news/portal_b1.php?cnt_id=19622
Response headers:
x-vercel-mitigated: deny- No
x-legacy-edgeheader - Body:
Forbidden
Expected behavior
- HTTP 404
x-legacy-edge: not-found- Body:
The page could not be found
Verification
The same deployment correctly returns HTTP 404 on its Vercel deployment hostname when accessed with Deployment Protection authorization.
After promoting the verified deployment to our production domain, the same URLs return HTTP 403.
Two valid legacy article redirects continue to work:
/news/portal_b1_page.php?cnt_id=19622→ HTTP 301/news/portal_b1_page.php?cnt_id=19612→ HTTP 301
The homepage, model pages, articles, events, and public API all pass regression testing.
We have also verified that:
- No published custom firewall rules are active.
- The Firewall Events API returned no matching deny events.
- Explicit edge routing rules already exist for the affected PHP paths.
- We do not want to disable security protections or use IP-based bypass rules.
Example request IDs
hkg1::mmksb-1793774284581-2f1cb969acbahkg1::42sl9-1793774284722-f8612eb8950d
Question for Vercel engineers
Why does the platform-level PHP probe mitigation prevent our explicit routing rules from returning HTTP 404 on the production domain, while the same deployment works on its deployment hostname?
Is there a supported configuration that preserves our existing 301 redirects and allows these unmapped legacy URLs to return genuine HTTP 404 without weakening platform security?
Thank you for your assistance.