Vercel Prod Checklist

Overview

Complete pre-production checklist for Vercel deployments covering environment variables, domain configuration, performance, security, monitoring, and instant rollback procedures.

Prerequisites

• Staging deployment tested and verified
• Production domain DNS configured
• Production environment variables set
• Monitoring and alerting configured

Instructions

Step 1: Pre-Deploy Verification

# Verify production env vars are set
vercel env ls --environment=production

# Required production variables (example):
# DATABASE_URL — production database
# API_SECRET — production API key (type: sensitive)
# NEXT_PUBLIC_API_URL — public API endpoint
# SENTRY_DSN — error tracking

# Build locally to catch errors before deploying
vercel build --prod

# Run test suite
npm test

Step 2: Production Deploy

# Option A: Deploy directly to production
vercel --prod

# Option B: Promote an existing preview deployment
vercel promote https://my-app-git-main-team.vercel.app

# Option C: Deploy via API
curl -X POST "https://api.vercel.com/v13/deployments" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-app",
    "target": "production",
    "gitSource": {
      "type": "github",
      "repoId": "123456789",
      "ref": "main",
      "sha": "abc123"
    }
  }'

Step 3: Domain Configuration

# Add production domain
vercel domains add yourdomain.com

# Verify domain DNS
vercel domains inspect yourdomain.com

# DNS setup for apex domain (yourdomain.com):
# A record → 76.76.21.21
# AAAA record → (Vercel provides)

# DNS setup for subdomain (www.yourdomain.com):
# CNAME → cname.vercel-dns.com

# SSL is automatically provisioned after DNS verification

Step 4: Post-Deploy Health Checks

# Verify production is responding
curl -sI https://yourdomain.com | head -5

# Test API endpoints
curl -s https://yourdomain.com/api/health | jq .

# Check SSL certificate
curl -vI https://yourdomain.com 2>&1 | grep "SSL certificate"

# Verify security headers
curl -sI https://yourdomain.com | grep -i "strict-transport\|x-frame\|x-content-type"

# Test from multiple regions (using Vercel's edge)
for region in iad1 sfo1 cdg1 hnd1; do
  echo "Region: $region"
  curl -s -H "x-vercel-ip-country: US" https://yourdomain.com/api/health
done

Step 5: Instant Rollback Procedure

# If something goes wrong — instant rollback (no rebuild needed)
vercel rollback

# Or rollback to a specific deployment
vercel rollback dpl_xxxxxxxxxxxx

# Or via API
curl -X POST "https://api.vercel.com/v9/projects/my-app/promote" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"deploymentId": "dpl_previous_good_deployment"}'

# Verify rollback succeeded
vercel ls --prod
curl -s https://yourdomain.com/api/health

Step 6: Configure Function Regions and Limits

// vercel.json — production optimization
{
  "regions": ["iad1"],
  "functions": {
    "api/**/*.ts": {
      "memory": 1024,
      "maxDuration": 30
    },
    "api/heavy-compute.ts": {
      "memory": 3008,
      "maxDuration": 60
    }
  }
}

Production Checklist

Build & Deploy

• [ ] npm run build succeeds locally
• [ ] All tests passing
• [ ] No TypeScript errors (npx tsc --noEmit)
• [ ] Preview deployment tested by team
• [ ] vercel --prod or promotion executed

Environment Variables

• [ ] All required vars set for Production environment
• [ ] Secrets typed as sensitive (hidden in logs)
• [ ] No NEXTPUBLIC prefix on secrets
• [ ] Database URLs point to production instances

Domain & SSL

• [ ] Custom domain added and DNS verified
• [ ] SSL certificate auto-provisioned and valid
• [ ] www subdomain redirects correctly
• [ ] HSTS header enabled

Security

• [ ] Security headers configured (CSP, X-Frame-Options, etc.)
• [ ] Preview deployment protection enabled
• [ ] API routes require authentication
• [ ] CORS configured for production origins only

Performance

• [ ] Function regions set closest to your database
• [ ] maxDuration set appropriately per function
• [ ] Cache-Control headers configured
• [ ] Bundle size within budget (check with vercel inspect)
• [ ] Core Web Vitals in green (LCP < 2.5s, CLS < 0.1)

Monitoring

• [ ] Error tracking configured (Sentry, Datadog, etc.)
• [ ] Vercel Analytics enabled in dashboard
• [ ] Runtime logs accessible
• [ ] Alert on error rate spikes

Rollback

• [ ] Previous production deployment identified for rollback
• [ ] vercel rollback tested in staging
• [ ] Team knows rollback procedure

Output

• Production deployment live on custom domain
• Health checks passing
• Security headers verified
• Rollback procedure documented and tested

Error Handling

Resources

• Production Deployments
• Instant Rollback
• Promoting Deployments
• Custom Domains
• Function Configuration

Next Steps

For version upgrades, see vercel-upgrade-migration.