The Vercel WAF can now protect a Vercel Blob store. The same rules that guard your deployments (deny, challenge, rate limit) now apply to blob traffic with no changes to your code, blob URLs, or @vercel/blob .

Protect a Blob store from its settings, no code changes required.

Every blob is already served through Vercel's CDN , so protection is a switch on the store, not a new proxy. Stop scrapers, geo-restrict downloads, rate limit expensive assets, or block abusive IPs before a byte is served.

Rules evaluate at the edge, matching on IP, country, path, and more :

Deny returns a 403 and stops the request early, so no data transfer is incurred.

Challenge serves the standard browser challenge, and a request that fails it is blocked.

Rate limit returns a 429 when a client exceeds your limit.

Redirect and log behave as they do for deployment traffic.

The OWASP Core Ruleset is not supported, since it targets dynamic application traffic, not object delivery.

Copy link to heading Protecting a store

Setup is…