Vercel Prod Checklist

Vercel Prod Checklist

Overview

Complete pre-production checklist for Vercel deployments covering environment variables, domain configuration, performance, security, monitoring, and instant rollback procedures.

Prerequisites

• Staging deployment tested and verified
• Production domain DNS configured
• Production environment variables set
• Monitoring and alerting configured

Instructions

Step 1: Pre-Deploy Verification

# Verify production env vars are set
vercel env ls --environment=production

# Required production variables (example):
# DATABASE_URL — production database
# API_SECRET — production API key (type: sensitive)
# NEXT_PUBLIC_API_URL — public API endpoint
# SENTRY_DSN — error tracking

# Build locally to catch errors before deploying
vercel build --prod

# Run test suite
npm test

Step 2: Production Deploy

# Option A: Deploy directly to production
vercel --prod

# Option B: Promote an existing preview deployment
vercel promote https://my-app-git-main-team.vercel.app

# Option C: Deploy via API
curl -X POST "https://api.vercel.com/v13/deployments" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-app",
    "target": "production",
    "gitSource": {
      "type": "github",
      "repoId": "123456789",
      "ref": "main",
      "sha": "abc123"
    }
  }'

Step 3: Domain Configuration

# Add production domain
vercel domains add yourdomain.com

# Verify domain DNS
vercel domains inspect yourdomain.com

# DNS setup for apex domain (yourdomain.com):
# A record → 76.76.21.21
# AAAA record → (Vercel provides)

# DNS setup for subdomain (www.yourdomain.com):
# CNAME → cname.vercel-dns.com

# SSL is automatically provisioned after DNS verification

Step 4: Post-Deploy Health Checks

# Verify production is responding
curl -sI https://yourdomain.com | head -5

# Test API endpoints
curl -s https://yourdomain.com/api/health | jq .

# Check SSL certificate
curl -vI https://yourdomain.com 2>&1 | grep "SSL certificate"

# Verify security headers
curl -sI https://yourdomain.com | grep -i "strict-transport\|x-frame\|x-content-type"

# Test from multiple regions (using Vercel's edge)
for region in iad1 sfo1 cdg1 hnd1; do
  echo "Region: $region"
  curl -s -H "x-vercel-ip-country: US" https://yourdomain.com/api/health
done

Step 5: Instant Rollback Procedure

# If something goes wrong — instant rollback (no rebuild needed)
vercel rollback

# Or rollback to a specific deployment
vercel rollback dpl_xxxxxxxxxxxx

# Or via API
curl -X POST "https://api.vercel.com/v9/projects/my-app/promote" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"deploymentId": "dpl_previous_good_deployment"}'

# Verify rollback succeeded
vercel ls --prod
curl -s https://yourdomain.com/api/health

Step 6: Configure Function Regions and Limits

// vercel.json — production optimization
{
  "regions": ["iad1"],
  "functions": {
    "api/**/*.ts": {
      "memory": 1024,
      "maxDuration": 30
    },
    "api/heavy-compute.ts": {
      "memory": 3008,
      "maxDuration": 60
    }
  }
}

Production Checklist

Build & Deploy

• npm run build succeeds locally
• All tests passing
• No TypeScript errors (npx tsc --noEmit)
• Preview deployment tested by team
• vercel --prod or promotion executed

Environment Variables

• All required vars set for Production environment
• Secrets typed as sensitive (hidden in logs)
• No NEXT_PUBLIC_ prefix on secrets
• Database URLs point to production instances

Domain & SSL

• Custom domain added and DNS verified
• SSL certificate auto-provisioned and valid
• www subdomain redirects correctly
• HSTS header enabled

Security

• Security headers configured (CSP, X-Frame-Options, etc.)
• Preview deployment protection enabled
• API routes require authentication
• CORS configured for production origins only

Performance

• Function regions set closest to your database
• maxDuration set appropriately per function
• Cache-Control headers configured
• Bundle size within budget (check with vercel inspect)
• Core Web Vitals in green (LCP < 2.5s, CLS < 0.1)

Monitoring

• Error tracking configured (Sentry, Datadog, etc.)
• Vercel Analytics enabled in dashboard
• Runtime logs accessible
• Alert on error rate spikes

Rollback

• Previous production deployment identified for rollback
• vercel rollback tested in staging
• Team knows rollback procedure

Output

• Production deployment live on custom domain
• Health checks passing
• Security headers verified
• Rollback procedure documented and tested

Error Handling

Examples

Execute a production readiness check with a tested reversal

Before release, record the exact candidate and prior deployment IDs, verify Production-only variable names and domain configuration, and run authenticated synthetic checks that do not mutate customer data. Promote only through the protected release workflow while watching health and error thresholds. If a threshold fails, roll back to the recorded deployment, verify recovery, and leave the candidate available for diagnosis rather than attempting live fixes under pressure.

Resources

• Production Deployments
• Instant Rollback
• Promoting Deployments
• Custom Domains
• Function Configuration

Next Steps

For version upgrades, see vercel-upgrade-migration.