# Can people bypass Cloudflare by using my .vercel.app URL?

**Yes, if you have not closed it** - and this one is worth checking today. It applies specifically to apps on Vercel behind Cloudflare.

Every Vercel deployment gets a public `.vercel.app` URL *in addition* to your custom domain. That second URL goes **directly to Vercel, completely bypassing Cloudflare**. So every protection you configured at the edge - WAF rate limiting, Browser Integrity Check, bot rules, security-level challenges - **simply does not apply** when someone uses it. They are talking to your app with no bouncer at the door. And the URL is not secret: it is in your dashboard, in deployment logs, and often guessable from the project name.

**The trap most guides get wrong.** On the free Hobby plan, Vercel's "Standard Protection" does **not** protect your production domain - it only covers preview and generated deployment URLs, and Vercel treats the short `project-name.vercel.app` as production, so it stays public. Covering production needs a paid plan. And **deleting the alias does not stick**, because Vercel re-assigns it on the next deploy. This was verified live in 2026: projects set to "Standard Protection" on Hobby were still serving the app on `.vercel.app` with Cloudflare fully bypassed.

**The fix that works on every plan, for free:** a one-time redirect in `vercel.json` - when the incoming Host is any `*.vercel.app`, 307-redirect every path to your real domain. It lives in your deployed config, so it travels with every deploy and survives re-assignment. Make it the **first** redirect (redirects are first-match-wins and run before your SPA rewrite), use a **regex host** so it catches the auto-generated URLs too, and use a **307** so it preserves POST bodies - meaning an API call aimed at the bypass host never executes there. Your real domain is untouched, because the rule only fires on a `.vercel.app` Host.

Two lessons worth carrying: the live bypass hostname is often *not* the obvious `project-name.vercel.app` but a generated one, so match with a regex rather than a literal. And audit **every** path that can reach your app without passing your CDN, not just the first one you noticed. Full item: [https://www.tigzig.com/security/frontend](https://www.tigzig.com/security/frontend).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/can-people-bypass-cloudflare-via-my-vercel-app-url
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms