I would really need a staff to help me out please, thank you

Hey, thanks for the detail!

You're right that challenged requests from Bot Protection do count toward your Edge Request usage. This is because the challenge itself requires serving a response. However, there are ways to better protect yourself:

• Keep Attack Challenge Mode enabled as this provides the strongest protection and blocked requests don't count toward usage

• Use Custom WAF Rules to DENY (not challenge) traffic from specific patterns: block the /avatar.jpg path entirely if possible, JA4 fingerprinting to block bot patterns and set up geographic blocking if attacks come from specific regions.

• You should also turn on Spend Management to set hard limits and prevent unexpected charges.

I need the /avatar.jpg path, and I don’t see the option to include JA4 fingerprint in the blocking or whatever. And my spend management has been automatically turned on after the attack started. This doesn’t really help me and it’s not the solution

The attacks are still continuing from a lot of different IPs even turning on Im under attack mode, same path “/avatar.jpg”.

https://vercel.com/kb/guide/deny-traffic-from-a-set-of-ip-addresses

This might be helpful to deny that path?

Here's what I recommend:

1. Go to your project's Firewall settings

2. Create a Custom WAF Rule with these conditions:

   • Path equals /avatar.jpg
   • AND one of these patterns that distinguish bots: • Missing common headers (like Accept-Language, Accept-Encoding) • Suspicious User-Agent patterns • Request rate > X per minute from same IP
   • Action: DENY (not challenge)

3. Monitor your Edge Request logs to identify patterns unique to the attackers

DENIED requests are free, CHALLENGED requests cost money. Focus on denial rules rather than challenges

Does that help?

Im gonna get rid of the avatar.jpg file simply so my edge request quota doesn’t increase again which it probably will when the attackers find out I got rid of the file, watch my website’s deployment get paused in a few days because of this stupid quota thing and it’s not me that was challenging the requests it’s vercel’s bot protection feature or whatever

Literally with the vercel dashboard and the fact I only have pro plan i cannot even see the headers or whatever the requests are being done with, I can’t see anything or do anything. You guys just want money, for everything. I can’t do anything without it asking me for money

I'm sorry you feel this way. Let me send you a DM

Solution summary

To resolve this, the user should implement Custom WAF Rules with a DENY action rather than a challenge, as denied traffic does not count toward Edge Request usage. For immediate mitigation during an active attack, enabling Vercel's "Attack Challenge Mode" provides high-level protection where blocked requests are also excluded from usage billing.