What is the WAF Cybersecurity Advisor?
The WAF that tells you what's safe to block. ProtectMyWebsite is a managed web application firewall for campus and agency operators. Rules start in count. After about a day, the dashboard shows what is safe to promote to block — one click. The Advisor is the plain-English layer on that moment: it recommends Promote, Hold, or Needs allowlist, explains why in a few sentences, and leaves the decision to you. This page is the brand-hook answer to what is the Advisor? — product identity, not a DIY console walkthrough. If you want the operator playbook for false positives and form paths, read What's safe to block on a WAF?
Why this product exists
Most managed rule packs can deny traffic on day one. That is fine in a lab. It is painful when admissions, registration, permitting, FOIA, or payment forms must stay up. Operators who own many sites fear false positives more than another dashboard. They need a clear answer before they tighten: is this junk, or is this a real workflow?
ProtectMyWebsite's locked identity is the hook: The WAF that tells you what's safe to block. Verdicts are rule-based checks on that site's own logs and counts. The same evidence always gives the same answer.
Count mode does the observe work. The dashboard surfaces candidates. The Advisor explains the recommendation. You still click once.
That sequence — count → explain → human promote — is the product. The Advisor is the explain step, not a substitute for the WAF and not an unsupervised deny engine.
Count → promote (the foundation the Advisor sits on)
The Advisor only makes sense if you understand WAF count mode.
1. Rules start in count. New managed and custom candidates log matches; they do not deny traffic yet.
2. Real traffic runs for ~24 hours. Editors, monitors, LMS/IdP callbacks, and peak form hours show up in that window.
3. The dashboard shows what's safe to block. ProtectMyWebsite is built around this handoff: Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
4. You promote with one click. Promote moves that rule from observe to block.
The Advisor does not invent a new lifecycle. It reads the count-window evidence already on the Tuning / suggest panel and writes operator language on top: recommendation, why, and evidence (hit count, sample path/method, rule id — no raw PII).
The check is rule-based on that site's own logs and counts. The same evidence always gives the same answer. The panel never goes blank. The Advisor explains; it does not auto-block. The human still clicks.
Promote vs Hold vs Needs allowlist
The triad is the whole UX. Three labels, three operator meanings. That is WAF promote / hold / allowlist explained without a wall of regex.
The Advisor's "why" is two to four sentences: when relevant, it names likely benign campus or agency patterns so you are not guessing from raw counters after a form breaks.
Recommendations stay advisory. The human still promotes. There is no auto-block, no 24-hour auto-email that Mac reviewed every window, and no unsupervised deny. The same evidence always gives the same answer.
| Recommendation | Meaning for buyers and operators |
|---|---|
| Promote | Count hits look like junk or known abuse. Promoting to block is the low-regret move. |
| Hold | Hits are mixed, sparse, or timing is wrong (e.g. mid-registration surge). Wait or dig before you deny. |
| Needs allowlist | Legitimate traffic is matching — editors, monitors, partner or LMS callbacks. Allowlist or scope the rule before promote. |
What the Advisor is not
Positioning only works if the negatives are explicit.
Not an auto-block. The CTA is human. Promote remains an operator action. You still click once.
This is for campus and agency web teams protecting public sites and forms. The Advisor names Promote, Hold, or Needs allowlist from that site's logs. It does not block on its own.
Managed rule packs already detect known attack classes. The differentiator is telling you what's safe to block after count — then you click.
Not a replacement for setup or managed ops. DNS cutover, SSL at the edge, and origin left in place are still the managed WAF setup path — see /guides/managed-waf-setup. Guided DNS setup, with concierge help; hosting and CMS stay put. The Advisor lives in Tuning after traffic is on the edge. DIY vs managed covers console burden; count mode covers day 0–24 observe.
A product that tightens rules overnight with no human in the loop is a different risk profile for admissions and citizen services. Here, you still click Promote.
Who it is for
Higher education web and IT running many departmental properties, LMS-adjacent sites, and seasonal funnels. One false promote during registration week becomes tickets before it becomes a security win.
Government and agency teams with permitting, FOIA, payments, and citizen forms that cannot go dark because a generic pack misfired on an upload or free-text field.
Multi-site operators who want a managed edge without living in a DIY console. Self-serve includes the Advisor as operator assist. Larger Campus Estate paths get the same Advisor assist plus a human sales conversation — Talk to sales team for volume; we do not publish Estate dollar amounts on this page.
Pricing for a single property is straightforward: $150/site/month with a 14-day trial. See pricing and signup.
How a buyer should evaluate it on a demo
Ask for the Tuning panel on a site that has finished (or nearly finished) a count window:
1. Open a candidate rule with hits.
2. Read Promote | Hold | Needs allowlist and the short why.
3. Check evidence: window hit count, sample path/method, rule id.
4. Confirm the promote button is still yours — the Advisor did not flip deny for you.
5. Ask to see the same window twice: the same evidence always gives the same Promote, Hold, or Needs allowlist answer.
A complete demo of the brand hook should take under a minute once count evidence exists. That is intentional. The value is clarity at the promote moment.
The public walkthrough is Example University on example.com — example data, not a customer. A human still clicks Promote.
For the deeper false-positive and form-path examples (admissions POSTs, LMS callbacks, CMS editors, agency uploads, monitors), use What's safe to block on a WAF? — that guide owns the operator scenarios so this page stays the identity and buyer definition.
FAQ
What is the WAF Cybersecurity Advisor? It applies rule-based checks to that site's own WAF logs and counts. For each rule with window evidence it recommends Promote, Hold, or Needs allowlist, explains why in plain English, and shows hit/sample evidence. The same evidence always gives the same answer. You still click once. It is how the product delivers the WAF that tells you what's safe to block.
Does the WAF Cybersecurity Advisor block on its own? No. It is advisory only. Rules still start in count; promote is still a human action. The Advisor does not block attacks by itself and does not replace your click. The human still clicks.
What do Promote, Hold, and Needs allowlist mean? Promote = low-regret move to block based on junk/abuse-looking hits. Hold = mixed or thin evidence; wait. Needs allowlist = legitimate traffic is matching; allowlist or scope before deny. That triad is the Advisor UX.
How is this different from a firewall that blocks on its own? ProtectMyWebsite's brand hook is safe-to-block explanation after count — for campus and agency operators. Count → explain → human promote is the locked identity. The same evidence always gives the same answer.
Does self-serve include the Advisor? Yes. Self-serve at $150/site/month includes the Advisor as operator assist on the Tuning panel, with a 14-day trial. Campus Estate (many sites) also includes the Advisor; Talk to sales team for estate volume — no Estate pricing listed here.
Start here
ProtectMyWebsite is the managed WAF that tells you what's safe to block. The Advisor explains Promote, Hold, or Needs allowlist — you still decide, and you still click once.
Free passive scan grades a domain before you change DNS. 14-day trial · $150/site/month at signup. Campus Estate (many sites): Talk to sales team — the Advisor included as operator assist; no Estate dollar amounts on this page.
Product docs
Related
- All guides
- Example WAF Cybersecurity Advisor panel
- What's safe to block on a WAF?
- What is WAF count mode? (and why you start there)
- Managed WAF setup: DNS cutover to count mode
- DIY WAF vs managed: console burden or operator?
- Managed WAF pricing: is $150/site worth it?
- Pricing
- Free security scan
- Start a 14-day trial