Vercel WAF for Blob is now generally available and supported for production use on all plans. If you protected a store during the beta, nothing has changed: your rules and setup carry over exactly as they are.
Vercel WAF protects a Blob store with custom rules, the same kind you use to guard your deployments. Rules that match on properties like IP address, country, and path can deny, challenge, or rate limit requests to your stored objects. This requires no changes to your code, your blob URLs, or how you use @vercel/blob
.
Rules are evaluated at Vercel's edge, so a denied request is turned away before any data transfer occurs. Unwanted traffic to AI-generated media, user uploads, or paid downloads never reaches your store and never generates a bill.
To enable protection, open your Blob store's Settings tab, and in the Firewall section select Protect your store, then Enable firewall. This connects the store to a dedicated team-wide project where your Blob firewall rules live, shared by every store you protect.
Read the Blob security documentation to protect a store.