Solution summary
To resolve this, the user should implement Custom WAF Rules with a DENY action rather than a challenge, as denied traffic does not count toward Edge Request usage. For immediate mitigation during an active attack, enabling Vercel’s “Attack Challenge Mode” provides high-level protection where blocked requests are also excluded from usage billing.