The Vercel WAF can now protect a Vercel Blob store. The same rules that guard your deployments (deny, challenge, rate limit) now apply to blob traffic with no changes to your code, blob URLs, or @vercel/blob.

The Firewall section of a Blob store's settings, marked Beta. The card reads "This store has no firewall protection. Assign a project to protect it," with a Protect your store button.The Firewall section of a Blob store's settings, marked Beta. The card reads "This store has no firewall protection. Assign a project to protect it," with a Protect your store button.

Protect a Blob store from its settings, no code changes required.

Every blob is already served through Vercel's CDN, so protection is a switch on the store, not a new proxy. Stop scrapers, geo-restrict downloads, rate limit expensive assets, or block abusive IPs before a byte is served.

Rules evaluate at the edge, matching on IP, country, path, and more:

  • Deny returns a 403 and stops the request early, so no data transfer is incurred.

  • Challenge serves the standard browser challenge, and a request that fails it is blocked.

  • Rate limit returns a 429 when a client exceeds your limit.

  • Redirect and log behave as they do for deployment traffic.

The OWASP Core Ruleset is not supported, since it targets dynamic application traffic, not object delivery.

Copy link to headingProtecting a store

Setup is a single switch in the dashboard:

  • Open your Blob store, select Settings, then Protect your store.

  • Vercel connects it to a shared vercel-blob-default-project on your team. You author its rules with the standard rule builder, and they take effect immediately.

  • One rule set covers every protected store, so rules can't be scoped per store.

During the beta, setup is dashboard-only, and challenges need a browser to solve, so server-side @vercel/blob requests matching a challenge rule are blocked. Use challenge rules for browser traffic.

Vercel WAF for Blob is available in beta on all plans. See the documentation for the full setup.