# Usage & Pricing for Vercel WAF

Vercel Firewall features that are available under all plans, are free to use. This includes [DDoS mitigation](/docs/security/ddos-mitigation), [IP blocking](/docs/security/vercel-waf/ip-blocking), and [custom rules](/docs/security/vercel-waf/custom-rules). Vercel WAF plan-specific features such as [rate limiting](/docs/security/vercel-waf/rate-limiting) and [managed rulesets](/docs/security/vercel-waf/managed-rulesets) are priced as described in [priced features](#priced-features-usage).

## Free features usage

Although you are not charged for Firewall features available under all plans, you may incur [Edge Requests (ER)](/docs/manage-cdn-usage#edge-requests) and [incoming Fast Data Transfer (FDT)](/docs/manage-cdn-usage#fast-data-transfer) charges as described below.

| Feature                                                                                              | ER          | FDT         | Note                                                                                                            |
| ---------------------------------------------------------------------------------------------------- | ----------- | ----------- | --------------------------------------------------------------------------------------------------------------- |
| [WAF custom rule](/docs/security/vercel-waf/custom-rules)                                            | Charged     | Charged     | When a custom rule is active, you incur usage for every challenged or denied request.                           |
| [WAF custom rule with persistent actions](/docs/security/vercel-waf/custom-rules#persistent-actions) | Not charged | Not charged | As the requests are now blocked before being processed by the firewall, they do not count towards usage.        |
| [DDoS mitigation](/docs/security/ddos-mitigation)                                                    | Not charged | Not charged | Review [Do I get billed for DDoS?](/docs/security/ddos-mitigation#do-i-get-billed-for-ddos) for an explanation. |
| [Attack Challenge Mode](/docs/attack-challenge-mode)                                                 | Not charged | Not charged | When attack challenge mode is turned on, requests that do not pass the challenge will not count towards usage.  |
| [Account level IP Blocking](/docs/security/vercel-waf/ip-blocking#account-level-ip-blocking)         | Not charged | Not charged | Requests originating from these blocked IP addresses do not count towards usage.                                |
| [Project level IP Blocking](/docs/security/vercel-waf/ip-blocking#project-level-ip-blocking)         | Charged     | Charged     | This falls under custom rules.                                                                                  |

## Priced features usage

Enterprise only features are priced as described below.

### Rate limiting pricing

### Managed ruleset pricing


--------------------------------------------------------------------------------
title: "Sandbox CLI Reference"
description: "Based on the Docker CLI, you can use the Sandbox CLI to manage your Vercel Sandbox from the command line."
last_updated: "2026-02-03T02:58:49.861Z"
source: "https://vercel.com/docs/vercel-sandbox/cli-reference"
--------------------------------------------------------------------------------