ECH encrypts the hostname during the handshake. From outside the connection looks like it is going to a shared address, not to your domain.
In short
- On 14 August Vercel announced support for Encrypted Client Hello on its delivery network.
- Until now the site name travelled unencrypted even over HTTPS.
- It switches on automatically in supporting browsers, with no configuration.
A small detail few people know: even over HTTPS, the name of the site you are opening travels in the open. The content is hidden. The address is not.
The facts: on 14 August 2026 Vercel announced support for Encrypted Client Hello on its delivery network. ECH encrypts the server name indication during connection setup. To an outside observer the connection appears to go to the shared address vercel-ech.com instead of the real domain. It is supported by recent versions of Chrome, Edge and Firefox. It is managed at platform level and enables automatically where the browser supports it, for domains on Vercel DNS.
Who gains. The person on a public network whose provider no longer sees which sites they open. And the site operator who does not want to be easy to filter by name.
Who loses. Anyone who until now blocked or counted by domain name. Including networks that do it for good reasons.
Every act of hiding is both good news and awkward news. It depends which side of the network you stand on.
There is no CVE number here either, because there is no vulnerability. There is a change in what shows from outside.
The visual is generated code art. No third-party images.