What is WAF count mode? (and why you start there)

Campus and agency sites can't afford a rule that blocks real students, staff, or citizens. Count mode is how you put a web application firewall (WAF) in front of production without flipping every signature to "deny" on day one.

The short version

1. New rules start in count (log / observe).

2. Real traffic runs for about a day.

3. Your dashboard shows what's safe to promote to block.

4. You click once — no ticket roulette, no guessing from a raw log dump.

That's how ProtectMyWebsite runs it: Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.

Why count mode exists

Signature and managed-rule packs catch known abuse (bad bots, injection probes, upload tricks). They also misfire on odd but legitimate traffic: a form with unusual field names, a CMS path that looks like an exploit string, a monitoring tool that isn't on your allowlist yet.

Block-first on a busy admissions or permitting site means false positives show up as angry tickets. Count-first means you see the hits, confirm the pattern, then tighten.

What "good" looks like for a multi-site team

If you run a main site plus departmental CMS installs (WordPress, Drupal, BigTree, CivicPlus, and friends), put the shield up with rules in count. Watch auth paths, uploads, and form endpoints carefully — those are where plugin RCEs and login floods show up.

Promote only the rules that fire on junk, not on your own editors and scanners. Keep origin IPs off the public internet so a flood can't bypass the edge.

Body matching, not just pretty URLs

Attackers rewrite delivery. A rule that only matches a path often misses the same exploit in a POST body or multipart field. When you virtual-patch a fresh CMS issue, confirm the rule sees the semantic exploit — then run count before block.

How this differs from DIY

DIY edge setups leave you staring at raw counters and deciding which rules to flip. Managed count mode is the same idea with a clearer handoff: observe → dashboard suggestion → one-click promote.

Promote Copilot reads your count window and explains what's safe to promote — you still click once.

When it says Needs allowlist, add an Allow match for the observed path or method in Custom rules first. Copilot does not write the allowlist. Re-check the count window before you promote.

When you do promote, blocked visitors see a branded 403 with a reference they can send you — not a blank error page.

See what would hit your site — then start in count

Start a 14-day trial Scan your site — free Pricing