What is WAF count mode? (and why you start there)
Campus and agency sites can't afford a rule that blocks real students, staff, or citizens. Count mode is how you put a web application firewall (WAF) in front of production without flipping every signature to "deny" on day one.
The short version
1. New rules start in count (log / observe).
2. Real traffic runs for about a day.
3. Your dashboard shows what's safe to promote to block.
4. You click once — no ticket roulette, no guessing from a raw log dump.
That's how ProtectMyWebsite runs it: Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
Why count mode exists
Signature and managed-rule packs catch known abuse (bad bots, injection probes, upload tricks). They also misfire on odd but legitimate traffic: a form with unusual field names, a CMS path that looks like an exploit string, a monitoring tool that isn't on your allowlist yet.
Block-first on a busy admissions or permitting site means false positives show up as angry tickets. Count-first means you see the hits, confirm the pattern, then tighten.
What "good" looks like for a multi-site team
If you run a main site plus departmental CMS installs (WordPress, Drupal, BigTree, CivicPlus, and friends), put the shield up with rules in count. Watch auth paths, uploads, and form endpoints carefully — those are where plugin RCEs and login floods show up.
Promote only the rules that fire on junk, not on your own editors and scanners. Keep origin IPs off the public internet so a flood can't bypass the edge.
Body matching, not just pretty URLs
Attackers rewrite delivery. A rule that only matches a path often misses the same exploit in a POST body or multipart field. When you virtual-patch a fresh CMS issue, confirm the rule sees the semantic exploit — then run count before block.
How this differs from DIY
DIY edge setups leave you staring at raw counters and deciding which rules to flip. Managed count mode is the same idea with a clearer handoff: observe → dashboard suggestion → one-click promote.