Sanity & Vercel pricing: What causes bills to spike and how to prevent it?

Great question! This is exactly the kind of due diligence you should be doing before pitching a stack to an agency. Let me break this down for you.

Sanity Pricing (2025)

Based on Sanity's official pricing page, here's what you need to know:

Free Plan:

• Unlimited API CDN requests (the fast, cached reads your marketing site will mostly use)
• 200,000 API requests per month (uncached reads/writes)
• 10GB bandwidth
• 10GB assets storage
• 10,000 documents
• Up to 20 users
• 2 datasets (public only)

Growth Plan: $15 per user/month (not $100 - that might be outdated info)

• Everything in Free, plus:
• Private datasets
• 5 permission roles (vs 2 on Free)
• AI Assist
• Comments, Tasks, Content Releases
• Scheduled Publishing
• Pay-as-you-go for overages

Overage pricing (when you exceed Free tier limits):

• API CDN requests: Very generous, typically not a concern
• API requests: Charged per million over quota
• Bandwidth: Charged per GB over quota
• The pricing page has these specific rates

For a simple marketing site with proper caching (which Next.js + Vercel do automatically), you'll almost certainly stay on the free tier. The unlimited API CDN requests are key here - that's what visitors hitting your site will use.

Vercel Pricing

Vercel's free Hobby tier is genuinely generous for small projects, but the Pro plan is $20/month per user (you had this right). The key limits to watch:

• Bandwidth on free tier
• Image optimization credits
• Serverless function execution time
• Build minutes

Questions to Answer as a Team

1. Expected traffic volume: How many page views per month realistically?
2. Content update frequency: How often will content editors make changes?
3. Media/asset strategy: How many images? What sizes? Will you use Sanity's image CDN or another service?
4. Number of editors: How many people need access to Sanity Studio?
5. Build frequency: How often will the site rebuild on Vercel?
6. ISR/caching strategy: Will you use Next.js ISR (Incremental Static Regeneration) to minimize API calls?

When Costs Escalate

Sanity: Costs jump when you:

• Need more than 20 users (requires Growth plan at $15/user/month)
• Exceed 200k API requests/month (but with proper caching, unlikely for a marketing site)
• Store massive amounts of assets (10GB is actually quite a lot)
• Need private datasets or advanced features

Vercel: Costs escalate with:

• High bandwidth usage (most common culprit)
• Excessive image optimization
• Many serverless function invocations
• Lots of builds

The Horror Stories - Are They Real?

Yes, but they're preventable. Here's what causes them:

Bot/DDoS traffic: This is the big one. Malicious traffic can spike your bandwidth and serverless function calls.

How to protect yourself:

1. Implement rate limiting: Use Vercel's Edge middleware or services like Cloudflare
2. Add bot protection: Vercel has built-in bot protection on Pro plans; consider Cloudflare for free tier
3. Set up monitoring and alerts: Both Vercel and Sanity let you set usage alerts
4. Use proper caching: Next.js ISR or SSG (Static Site Generation) means most requests never hit Sanity
5. Enable Vercel's DDoS protection: Included in Pro plans
6. Configure Vercel spending limits: You can set hard caps on Pro plans to prevent runaway bills

Best practices for a marketing site:

• Use Static Site Generation (SSG) or ISR for most pages
• Set revalidation periods appropriate to your content update frequency (e.g., every hour or day)
• Optimize images before uploading to Sanity
• Use Sanity's image pipeline with proper sizing parameters
• Implement proper CDN caching headers
• Consider adding Cloudflare in front of Vercel for an extra protection layer (free tier available)

Realistic Cost Estimate for Your Marketing Site

Most likely scenario: $0-20/month

• Sanity: Free tier (unless you need 20+ editors)
• Vercel: Free tier for low-moderate traffic, or $20/month Pro for better protection and limits

If traffic grows significantly: $20-50/month

• Sanity: Still likely free unless you hit API request limits
• Vercel: Pro plan ($20) + potential small overages

The $2k horror scenario happens when:

• No rate limiting + bot attack + no spending caps = disaster
• This is 100% preventable with proper configuration

My Recommendation

Start on free tiers for both, but:

1. Implement the protective measures I mentioned above from day one
2. Set up usage monitoring and alerts immediately
3. Consider starting with Vercel Pro ($20/month) for the DDoS protection and spending limits
4. Monitor for the first month closely
5. Document your protection strategy for the agency

The generous free tiers are real, but treat them like production infrastructure - implement proper protections from the start. The horror stories come from developers who didn't set up basic safeguards.