Hi,
Our production domain https://sobotkiweddings.pl is being challenged by a Vercel system firewall rule and returns a “Vercel Security Checkpoint” page / HTTP 403 instead of our website.
We confirmed:
- the domain is connected to Production
- DNS is valid
- SSL is active
- Vercel Authentication is disabled
- Bot Protection is off
- AI Bots is off
- no custom firewall rules are configured
- Attack Mode is off
In Firewall overview we can see:
- System Rule
- Action: Challenge
- Hostname: sobotkiweddings.pl
This is breaking the public website and makes it look like assets/files are missing, but in reality the request is intercepted before our app is served.
Could you please check and remove the false positive mitigation on sobotkiweddings.pl?
Timestamp observed:
March 15, 2026 around 22:41 CET
Thanks
Are you seeing “Vercel Security Checkpoint” right now? (yes/no)
Where are you located (country + city) and which network (home/work/mobile; ISP name)?
Which device + browser (e.g. iPhone Safari / Windows Chrome) and are you using VPN/adblocker/proxy (yes/no; which)?
Exact URL you opened (apex sobotkiweddings.pl or www.sobotkiweddings.pl, and any subpage).
Time it happened (include timezone).
Screenshot of the full page showing the checkpoint.
Can you return the response after running this commands?
Windows: curl -sS -D - -o NUL https://www.sobotkiweddings.pl/ | findstr /i “HTTP/ x-vercel-id server location content-type”
macOS: curl -sS -D - -o /dev/null https://www.sobotkiweddings.pl/ | sed -n ‘1,60p’
Yes.
I am seeing inconsistent behavior right now.
Location: Gliwice, Poland
Network: home
ISP: Sownet
Device/browser: MacBook Pro
VPN/adblock/proxy: no adblock, no VPN, no proxy
Exact URLs opened:
Observed time:
March 16, 2026 around 11:25–11:40 CET / Europe/Warsaw
Current behavior is intermittent:
- sometimes https://www.sobotkiweddings.pl/ returns the Vercel Security Checkpoint page
- sometimes the page partially renders, but major images/assets fail to load and appear blank
I’m attaching:
- a screenshot of the Vercel Security Checkpoint page
- a screenshot of the partially rendered page with missing assets
curl results from macOS:
For apex:
HTTP/2 307
cache-control: public, max-age=0, must-revalidate
content-type: text/plain
date: Mon, 16 Mar 2026 10:25:16 GMT
location: https://www.sobotkiweddings.pl/
server: Vercel
strict-transport-security: max-age=63072000
x-vercel-id: arn1::gfjwm-1773656716944-38ad321dc3e6
For www:
HTTP/2 403
cache-control: private, no-store, max-age=0
content-type: text/html; charset=utf-8
server: Vercel
x-vercel-challenge-token: present
x-vercel-id: arn1::1773656719-f8XhfOAmhHxctXLHIglhpaFLs82nzJK4
x-vercel-mitigated: challenge
So right now the apex domain redirects to www, and www is intermittently challenged by a Vercel system mitigation rule instead of serving the website reliably.
