The Vercel WAF can now protect a Vercel Blob store. The same rules that guard your deployments (deny, challenge, rate limit) now apply to blob traffic with no changes to your code, blob URLs, or @vercel/blob.

Protect a Blob store from its settings, no code changes required.

Every blob is already served through Vercel's CDN, so protection is a switch on the store, not a new proxy. Stop scrapers, geo-restrict downloads, rate limit expensive assets, or block abusive IPs before a byte is served.

Rules evaluate at the edge, matching on IP, country, path, and more:

Deny returns a 403 and stops the request early, so no data transfer is incurred.

Challenge serves the standard browser challenge, and a request that fails it is blocked.

Rate limit returns a 429 when a client exceeds your limit.

Redirect and log behave as they do for deployment traffic.

The OWASP Core Ruleset is not supported, since it targets dynamic application traffic, not object delivery.

Open your Blob store, select Settings, then Protect your store.

Vercel connects it to a shared vercel-blob-default-project on your team. You author its rules with the standard rule builder, and they take effect immediately.

One rule set covers every protected store, so rules can't be scoped per store.

During the beta, setup is dashboard-only, and challenges need a browser to solve, so server-side @vercel/blob requests matching a challenge rule are blocked. Use challenge rules for browser traffic.

Vercel WAF for Blob is available in beta on all plans. See the documentation for the full setup.