Score in middleware.ts before the route renders, so blocked traffic never reaches your server components or your data layer.
Next.js apps often push rendering to the edge, which is good for speed but means there is no single server-side choke point where you can inspect traffic. middleware.ts restores one: it runs before route resolution, so a blocked request never triggers rendering, never calls your data layer, and never costs you a function invocation. The trade-off is that middleware sits on the critical path for every matched route, so keep the matcher narrow and skip static assets.
middleware.ts
Full endpoint reference and an interactive tester are in the API docs. Get a key from the free tier — no card required.
If your pages render data server-side, a scraper pays nothing for the HTML you paid a database query for. Server-rendered content is more expensive to serve than a static page and equally easy to harvest.
Route handlers under /api are public unless you guard them, and Next.js makes it easy to ship one without thinking about auth.
Staging and preview deployments left reachable are a common source of indexed duplicate content and unintended public access.
Yes. The middleware uses fetch and URLSearchParams only, both of which are available in the edge runtime. Do not add Node-only imports.
One HTTP round trip on matched routes, median under 50ms. The matcher in the snippet excludes static assets, which is the main thing to get right.
A shared corporate IP with normal browser behaviour scores low, because the score is composite rather than IP-only. Every block is logged with its reason so you can review and whitelist.
Free tier, real verdicts, and documentation with a built-in tester.
Get started free →