In May 2026, Combating bots to keep Vercel costs down became a trending topic on Zenn, as a surge in AI crawlers and malicious bots caused monthly Vercel bills to spike 3x to 10x higher than expected, an incident occurring frequently across corporate websites and SaaS frontends built for clients.
Until now, Vercel has been adopted for its simple premise of "push to deploy," but as metered billing was subdivided into three separate streams—Edge Requests, Image Optimization, and Functions—it created a structure where the behavior of a single bot can spin multiple meters simultaneously. This article outlines the 2026 edition of procedures for designing "billing guardrails" in client development.
Why Vercel bills began surging — Three structural shifts
Shift 1: AI crawlers hitting "image optimization"
AI crawlers such as GPTBot, ClaudeBot, and PerplexityBot retrieve every OG image and in-article image. Because Vercel's Image Optimization is billed per transformation, it is no longer uncommon to see cases where a single page's OG image undergoes 50,000 optimizations per month.
Shift 2: Scraper bots hitting every single page
Scrapers targeting pricing info, inventory data, and article text generate hundreds of thousands of Edge Requests per day. Vercel Edge Requests can be subject to billing even on cache hits, and misdesigning CDN costs can result in bills that are an order of magnitude higher.
Shift 3: Frequent cold starts of Server Functions
When bots continuously hit uncached paths, Server Functions launch constantly, accumulating prolonged billable execution time. This shares the same structure as the agent hosting discussion covered in Vercel Open Agents Maintenance for Clients.
Three common "billing incident" patterns in client development
| Variant | Trigger | Monthly impact |
|---|---|---|
| OG image bombardment | AI crawlers + Image Optimization | +50,000 to 300,000 yen |
| Article scraping | Competitor bots + Edge Requests | +100,000 to 800,000 yen |
| ISR regeneration loop | Unauthorized access + Functions | +30,000 to 200,000 yen |
OG image bombardment in particular is problematic due to its irreversible nature—"by the time a budget overage alert arrives, the bill is already enormous"—making proactive billing guardrail design essential.
Four-layer design of billing guardrails
To "achieve zero billing incidents" in client projects, embed four layers of defense right from the contract's inception.
Layer 1: Stop threats at the edge (Cloudflare upstream)
Place Cloudflare in front of Vercel to intercept bots via Bot Fight Mode, AI Audit, and Rate Limiting before they reach Vercel. This follows the same philosophy as Cloudflare AI Labyrinth Scraper Defense, where "reducing the requests Vercel sees to 1/10th" directly slashes billing.
Layer 2: Identify at the host level (middleware.ts)
Check User-Agent, IP, and Cookie headers in Vercel's middleware.ts and route unknown bots to a 403 or robots.txt path. This layer cheaply blocks bots that slipped past Cloudflare using Vercel's Edge Middleware (which includes a free tier).
Layer 3: Whitelisting Image Optimization
Restrict images.remotePatterns in next.config.js to "company domains only" to structurally prevent optimization requests from external URLs. Offloading OG images to static generation + Cloudflare Cache is also an economical approach.
Layer 4: Automated billing alerts
Set up monthly budget alerts in Vercel's Spend Management to trigger Slack/email notifications and automated shutdowns upon exceeding thresholds. Include "mandatory configuration at project inception" as an agreed-upon term in client contracts.
Selection criteria: Vercel vs Cloudflare Pages
| Item | Vercel | Cloudflare Pages |
|---|---|---|
| Edge Request unit price | Higher (subdivided billing) | Lower (comprehensive) |
| Image Optimization | Billed per transformation | Included, with Polish |
| Standard bot protection | Configured separately | Robust out of the box |
| Next.js compatibility | Full support | Some constraints |
| Enterprise budget | From 500,000 yen/month | From 200,000 yen/month (comparable scale) |
As a baseline rule for 2026: choose Vercel if your goal is "leveraging Next.js + designing billing guardrails," and choose Cloudflare Pages for "Astro / Hono + cost optimization." For Astro architectures, combining this with the Hono Cloudflare Workers Edge API Guide maximizes results.
"Billing guardrail clauses" to include in client contracts
| Clause | Details | What the client should verify |
|---|---|---|
| Monthly budget ceiling | Ceiling amount in Vercel Spend Management | Monthly operational impact scope |
| Bot identification policy | Administrator of allowed/denied bot lists | Impact on existing SEO crawlers |
| Emergency shutdown criteria | Shutdown decision-making upon anomaly traffic detection | Client-side contact flow |
| Cloudflare co-management responsibilities | Managing entity for the upstream CDN | Downtime during DNS switchover |
| Incident response SLA | From billing spike detection to response kickoff | Availability of off-hours contact |
In particular, it is crucial that "emergency shutdown criteria" are specified numerically, such as "automatic shutdown when billing exceeds 1 million yen." Vague agreements like "wait and see" invite disaster.
Four common pitfalls
Pitfall 1: Misunderstanding that "Vercel Pro keeps you safe"
Vercel Pro lacks a comprehensive cap, leaving bot traffic subject to uncapped metered billing. Explain clearly to clients that a Pro subscription is no substitute for billing guardrails.
Pitfall 2: Upstream Cloudflare breaking SSR
Overly aggressive caching in Cloudflare can lead to accidents where Next.js SSR / ISR is inadvertently cached. Explicitly establish a rule that "dynamic routes bypass cache."
Pitfall 3: Disabling Image Optimization degrades LCP
Stopping resizing and WebP conversions worsens Core Web Vitals, impacting SEO. Prepare an architecture that substitutes it with "static generation + Cloudflare Polish."
Pitfall 4: robots.txt alone won't stop them
Ill-behaved AI crawlers ignore robots.txt. Always combine it with User-Agent-based 403 responses.
Conclusion — From "it just works" to "billing won't break"
Vercel's structural changes mark the end of the "push to deploy" era. In client projects, designing "billing guardrails" at the start of the contract represents the single greatest responsibility for safeguarding the client's monthly P&L.
Whether you are facing situations like "our Vercel bill suddenly jumped 10x" or "OG image costs from AI crawlers won't stop climbing," we provide custom quotes for designing and implementing billing guardrails based on your site scale and traffic profile. Please feel free to reach out via our inquiry form.
