Netlify is, on this specific axis, the riskier of the two big Jamstack hosts — and it is not close.
Netlify has no spend cap, no automatic pause, and no user-defined usage alerts. You get emails at 50%, 75% and 100%, and Netlify's own docs point you at third-party tooling if you want anything more. The most reliable manual kill switch is setting a site password, which makes the site inaccessible and stops the traffic.
What Netlify actually gives you#
Usage emails at 50%, 75% and 100% of your plan allowance, plus in-app notifications. Fixed thresholds — you cannot ask for 85%.
And that is it. There is no equivalent of Vercel's Spend Management. No amount you can nominate, no automatic pause, no hard cap.
Netlify is upfront about this. Their observability documentation states that if you need alerting, you should set up a log drain to a third-party monitoring tool. They are explicitly outsourcing the capability.
Netlify's own forum has threads open for years on exactly this:
- "Simple question: Can you just take my site offline if I go over the bandwidth limit" — open since 2020, and also submitted to Hacker News.
- "Limit bandwidth to avoid high billing caused by DDoS?" — open since April 2020.
- "Clarification on DDoS Attack Fees and Protections" — a 100k+ charge.
- "Unexplained bandwidth spike (97GB in 3 days) on low-traffic site".
- "Urgent Site Under Attack and Getting Billed for Massive Functions Usage".
The demand is documented and long-standing. The feature is not there.
Three things that do work#
1. Password-lock the site (the practical kill switch)#
Setting a site password makes the site inaccessible to visitors. No visitors, no bandwidth, no function invocations. It is not marketed as a kill switch, but it functions as one, and it is reversible in one step.
Via the sites API:
curl -X PATCH "https://api.netlify.com/api/v1/sites/$SITE_ID" \
-H "Authorization: Bearer $NETLIFY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"password": "stopped-'$(date +%s)'"}'
Clear the password to restore. This is exactly what MONII's Netlify kill switch does — the value is having it on a phone attached to an alert, not the API call itself, which you can run yourself in ten seconds.
2. Unlink the repository#
Stops builds, leaves the current deploy serving. Right when the problem is a build loop rather than traffic — you stop burning build minutes without taking the site down.
3. Roll back to a lighter deploy#
If a specific deploy introduced the expensive behaviour — an uncached route, a runaway function — restoring the previous one fixes the cause rather than symptom-treating it.
curl -X POST "https://api.netlify.com/api/v1/sites/$SITE_ID/deploys/$DEPLOY_ID/restore" \
-H "Authorization: Bearer $NETLIFY_TOKEN"
Prevention, since the reaction options are thin#
Given how little Netlify offers reactively, the preventative layer matters more here than on Vercel:
- Put Cloudflare in front. Genuinely the strongest move available. Absorbs attack traffic before it reaches Netlify's meter.
- Cache hard. Every cached response is bandwidth Netlify does not bill.
- Watch usage yourself, because Netlify will only tell you at 50%, 75% and 100%, by email. See Netlify bandwidth alerts.
MONII's Netlify kill switch has no native competitor — Netlify simply does not offer the capability. Alerts at any percentage you choose, pushed to your phone, with the password-lock attached to the notification.
The honest caveat, same as everywhere else on this site: MONII polls roughly every fifteen minutes and is not real-time. Put Cloudflare in front regardless.
Questions people actually ask
Does Netlify have a spending limit?
No. There is no spend cap and no automatic pause. Netlify sends usage emails at 50%, 75% and 100%, and that is the extent of the native protection.
Can Netlify take my site offline automatically if I exceed bandwidth?
Not automatically. This has been an open request on Netlify's own forum since 2020 — the thread 'Can you just take my site offline if I go over the bandwidth limit' is one of the most-cited examples.
What is the password-lock trick?
Setting a site password via the Netlify sites API makes the site inaccessible to visitors, which stops the traffic and therefore the bandwidth spend. It is reversible by clearing the password.
Does Netlify offer usage alerting?
Only the fixed 50/75/100% emails. Netlify's observability documentation explicitly suggests setting up a log drain to a third-party monitoring tool if you need real alerting.
A kill switch for Netlify
MONII's Netlify kill switch password-locks the site from your phone, stopping the traffic in one action. Reversible from the same screen.
Get MONII for iOS ›