Vercel WAF for Blob launches in beta

Vercel's WAF (Web Application Firewall) can now protect Vercel Blob stores. The Deny, Challenge, and Rate limit rules already used in existing deployment environments can be applied as-is, without any code modifications or URL changes.

Since all Blobs are already served through Vercel CDN, protection can be enabled with a single switch in the store settings, without needing to set up a separate proxy. This makes it possible to block scrapers, restrict downloads by country, rate-limit high-cost assets, and block malicious IPs.

Rules are evaluated at the Edge and support the following behaviors:

• Deny: Returns a 403 error and blocks the request early, preventing data transfer costs.
• Challenge: Presents a standard browser challenge; requests that fail to pass it are blocked.
• Rate limit: Returns a 429 error when a client exceeds the configured limit.
• Redirect/Log: Behaves the same as existing deployment traffic.

Configuration can be easily done from the Settings > Protect your store menu in the dashboard. However, during the beta period, only dashboard configuration is supported, and the Challenge rule should only be used for browser-based traffic (server-side @vercel/blob requests may be blocked).