If you're gonna default web guard to be on for new accounts and want it to protect it should be the lowest setting. I wish it wouldn't default to protection and simply be off for new accounts. But if you're gonna protect you might as well protect completely.
I didn't see in your FAQ or instructions or the web guard control page that it takes two hours to provision to the handset and also a reboot was requested by customer service. Rather than making me call and find this out its best to just say this everywhere! Less work for T-Mobile and less hold time for me. "Takes at least two hours for changes to take effect and please reboot your handset."
(Lol, and plans and services, very broad space)