Protected staging environment questions

Hi,

I’m planning a dedicated protected staging environment for a Next.js app using synthetic data only.

I’d like to confirm:

Can a new Vercel project be protected before the first real application deployment?
Can WAF block all public POST requests and selected GET/HEAD routes, including old deployment URLs?
Can we keep a narrow internal smoke-test lane while public access stays blocked?
Can rollback and smoke configurations use the same exact source revision without Production promotion?
Is outbound access restriction to a specific staging backend supported?
Are WAF and Deployment Protection included with Pro, or are additional costs required?

I’m currently on Hobby and could not open a private support case.

Thanks.

You can set a team-wide Deployment Protection default. If you pick All Deployments, every new project is protected from the moment it's created. Without a team default, new projects start on Standard Protection, which covers previews but not production domains. Vercel Authentication, All Deployments, and Protection Bypass for Automation are included on every plan

WAF custom rules can match on method, path, hostname, header and more, and can deny or challenge matching requests. Changes go live without a redeploy. But it sounds like Deployment Protection with All Deployments is the better option for what you want. WAF custom rules and IP blocking are free on all plans.

Protection Bypass for Automation is available on every plan. You can send a secret in the x-vercel-protection-bypass header, and everyone else still hits the protection. That token skips Deployment Protection, system mitigations and Bot Protection.

Hi,

I’m planning a dedicated protected staging environment for a Next.js app using synthetic data only.

I’d like to confirm:

Can a new Vercel project be protected before the first real application deployment?
Can WAF block all public POST requests and selected GET/HEAD routes, including old deployment URLs?
Can we keep a narrow internal smoke-test lane while public access stays blocked?
Can rollback and smoke configurations use the same exact source revision without Production promotion?
Is outbound access restriction to a specific staging backend supported?
Are WAF and Deployment Protection included with Pro, or are additional costs required?

I’m currently on Hobby and could not open a private support case.

Thanks.