Vercel WAF for Blob is now in beta
Vercel just brought enterprise security to object storage. WAF for Blob is now in beta—rate limiting, geo-blocking, and scraper protection at the edge, zero code changes.
Why it matters
Vercel is extending its Web Application Firewall to blob storage, giving developers edge-native security for unstructured data without infrastructure changes. Relevant for founders building data-heavy apps or dealing with bandwidth abuse.
The key facts
16 to knowVercel WAF for Blob now in beta
Available on all Vercel plans
Rules evaluate at edge (IP, country, path matching)
Four action types: deny (403), challenge (browser), rate limit (429), redirect/log
Single dashboard toggle activation
No code changes, URL changes, or proxy required
Shared rule set across all protected stores (not per-store scoping)
OWASP Core Ruleset not supported for object delivery
Server-side requests matching challenge rules currently blocked during beta
Vercel WAF for Blob now in beta across all plans
Protection rules evaluate at edge (IP, country, path matching)
Available actions: deny (403), challenge, rate limit (429), redirect, log
No code changes required; single dashboard toggle to enable
One ruleset covers all protected stores on a team
OWASP Core Ruleset not supported (targets dynamic app traffic, not object delivery)
Challenge rules require browser interaction (server-side requests blocked during beta)
Go to the source
Vercel Blogvercel.com
Publisher excerpt: The can now protect a Vercel Blob store. The same rules that guard your deployments (deny, challenge, rate limit) now apply to blob traffic with no changes to your code, blob URLs, or . Vercel WAF@vercel/blob Every blob is already served through , so protection is a switch on the store, not a new…