FortiWeb's DoS Protection > Application > HTTP Access Limit feature counts requests per source IP within a period and, once the configured threshold is exceeded, applies a Period Block action that returns an error (500) for further requests from that client until the block period expires. A browser loading a page issues the HTML request first and then several parallel requests for its referenced resources (script, stylesheet, favicon) almost simultaneously; if the access-limit threshold is set too low, the first request passes but the burst of sub-resource requests immediately exceeds the limit and gets blocked, producing 500 errors only for those trailing requests.
Community Discussion