What a WAF 403 page means (and why you start in count)
A 403 means the shield stopped a request before it reached the origin. On ProtectMyWebsite, visitors do not see that page on day one — rules start in count. After about a day, Promote Copilot explains what's safe to promote, and you still click once.
The short version
1. New rules start in count. Nothing is blocked yet.
2. Real traffic runs for about a day.
3. Promote Copilot reads that window and names what's safe.
4. You click once. Only then do blocked visitors see a branded 403.
The 403 is the last step, not the first. Count mode is how you get there without surprising real users.
What a branded 403 is for
A stock error page is a dead end: no reference, no owner, no next step. A branded 403 tells a real person what happened, gives them a request id to send the site owner, and keeps bots from getting a tour of the origin.
If you were just trying to use the site, it is probably a false positive. Share the reference with the owner. If you run the site, that id is the start of a tuning conversation — not a guess from a blank browser error.
Why count mode comes first
Signature packs catch junk. They also misfire on odd but legitimate traffic: a form with unusual field names, a CMS path that looks like an exploit string, a monitoring tool that is not on your allowlist yet.
Block-first on a busy campus or agency site means false positives show up as angry tickets and a 403 in someone's browser. Count-first means you see the hits, confirm the pattern, then tighten.
That's how ProtectMyWebsite runs it: Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
Promote Copilot and the one click
Promote Copilot reads your count window and explains what's safe to promote — you still click once.
When it says Needs allowlist, add an Allow match for the observed path or method in Custom rules first. Copilot does not write the allowlist. Re-check the count window before you promote. Nothing flips to block on its own.
If you just saw a 403
Visitors: contact the site owner and send the reference on the page. That is enough for a human to look up the request.
Site owners: start a 14-day trial, add the domain, and leave rules in count until Promote Copilot names what's quiet. $150/site/mo after the trial. Cancel before day 14 and you won't be charged.