5. Every day

The page "Blocked by Warda"#

When Warda blocks a site, the page used to just not open, and nobody knew why. From 0.8.4 Warda says it by default (from 0.8.3 an administrator could choose it): Network → DNS services → Answers, Answer to a blocked name → Block page: the address of Warda, which tells why (recommended). A box where an administrator chose another answer keeps it; to go back to the former behaviour, choose Null address 0.0.0.0 / :: there. A browser then shows Blocked by Warda, in its own language, with the site, the reason in plain words (a block list, a category blocked for the profile, the Internet hours…) and the time. On the device the site was blocked for, a button asks for more time (outside the Internet hours) or asks to unblock it (when unblock requests are available). Another device sees the site and the time, never the reason: nobody reads why someone else was blocked. Apps that are not browsers simply fail, as before.

Details and unblock request. On the device the site was blocked for, the page also gives the Category (for example "Ads, trackers and threats" or "Security"), what decided (Decided by: "The Warda base list", a rule of the network, the Internet hours or the profile of the person, the reputation of the domain…) and the Device with its person. Warda recognises the device whatever its address: a computer that asks Warda over IPv6 and opens the page over IPv4 sees its own reason too. Under What can you do?, Ask to unblock it sends a request to the person who manages the network, without signing in: choose For how long (15 to 60 minutes, or For good), add a Message (optional), then Send the request. The page answers "Request sent to the person who manages this network." and then shows whether the request is waiting, accepted or refused (with the answer). The administrators answer it where they answer the other requests (dashboard, Business → Unblock requests). When the requests are off, the page says "Unblock requests are not enabled on this network."; a block that protects the device (a threat, the hours of a child) cannot be asked. The administrators also find a link Rules to the interface of Warda (sign-in required).

Unblock for 15 minutes (Warda Business, open to everyone until subscriptions open, off by default). When an administrator allows it (chapter 5, Warda Business: data leaks and unblock requests), the page also offers Unblock it for 15 minutes now: choose Why (School site / homework, Work site, The site is blocked by mistake or Other), then Unblock for 15 minutes. The site opens on this device only, without waiting for an answer; the page says until when ("Unblocked for 15 minutes, until 14:32. Wait a minute, then reload this page."). A few times a day only: when the device or the network used its unblocks of the day, the page says so, and a request stays possible. Never for a threat, the hours of a child, a rule an administrator wrote, a suspicious domain, the data loss prevention, a connected object in restricted mode, or a VPN or proxy.

The logo of the company. With Warda Business, the page shows the logo of the company (chapter 5, Warda Business: security center, AI services and policies) instead of the Warda shield; once the site is unblocked on the device, the shield comes back.

What the household sees. Only the page you open shows "Blocked by Warda". The ads, trackers and images a page asks from blocked sites get an empty answer and show nothing: the rest of the page looks as before. A device that opens many blocked pages in a moment (more than 30 at once, then 2 a second) gets a short "Blocked by Warda" page without the details, which says to reload in a few seconds; an ad shown in a frame of another page gets the same short page.

Secure sites (https). Most sites are secure. For them the browser first shows a security warning ("Your connection is not private"), because the page comes from your Warda box and not from the site. To make the warning go, install the certificate of your Warda once on each device: open http://warda/certificate (or the link at the bottom of the block page), which gives the files and the steps for each system:

• Windows: download the certificate (.crt), open it, Install Certificate, and place it in Trusted Root Certification Authorities. Restart the browser.
• Mac: download the profile for iPhone, iPad and Mac, open it, then install it in System Settings → General → Device Management.
• iPhone and iPad: open the page in Safari, tap the profile, install it in Settings (Profile Downloaded), then turn on full trust in Settings → General → About → Certificate Trust Settings.
• Android: download the certificate (.crt), then in Settings search for "CA certificate" and choose the file.
• Linux and Firefox (which keeps its own certificates, on every system): follow the steps of the page.

Before you trust it, check that the fingerprint shown by the page is the one your device shows.

What installing it means. The device then trusts every certificate your Warda box makes. Warda makes them only for its block page, and its key never leaves the box. Install it only on your own devices, only from the Warda of your home, and remove it when a device leaves your network. Install it again when the box is replaced or restored from a backup, or when an administrator makes a new one; with two boxes (high availability), install the certificate of each.

Limits. The block page needs Warda on the ports 80 and 443 (with Docker on other ports, the page DNS services says so, and the default answer stays the null address). Without the certificate, some large sites show a warning with no way past it. A browser with its own secure DNS never asks Warda, and devices outside the home keep the usual answer.

An application or a site no longer works#

In Devices, click Something is broken next to the device:

1. Warda stops filtering it for 15 minutes: try again.
2. It shows what it blocked for it just before. If a name is the cause, Unblock for this device lets it through for this device only.

In an emergency, an administrator can pause the filtering of the whole network for 15 minutes from the dashboard. It shows in red on every page.

Suggestions#

In Suggestions, Warda explains each name it suspects: its role, the device, what happened just before. Block adds it to your rules; Keep allowed leaves it allowed and it is not suggested again.

The Watched names tab shows the suspicious names Warda is still watching, and why each one is not suggested yet: the observation period is not over (with its end date), its confidence is below the threshold of your learning level (with the level at which it would be suggested), only new devices ask for it (observed for 48 hours), only servers ask for it, or the weekly limit of suggestions is reached. Nothing there is blocked. A card at the top gives the level, the last analysis and the end of the observation; Analyse now runs the analysis at once (at most once a minute). When there is nothing left to decide, the page links to this tab; when learning is off, it says so, with a link to the settings.

At the top of Watched names, the card What Warda is watching says in plain words how many names Warda watches, that none of them is blocked, and how sure Warda must be before a name is suggested at your level: Low 90 %, Medium 70 %, High 50 % (the higher the level, the more names it suggests). The chart puts each name as a dot on a line from 0 to 100 %, with the threshold of each level; the dots at or above yours are Suggested at your level. Level of detail → Detailed adds why they are not suggested yet, and what they probably do.

Block confident new trackers automatically (from Warda 0.8.0, free, off by default), the card below the tabs, works only at the learning level High (chosen in Settings). With Block them automatically ticked, a new suggestion of a tracker or of a telemetry service (the reports a TV or an object sends to its maker) that Warda is at least 90 % sure of is blocked without waiting for you, at most as many a week as your suggestions a week. Never a vital service, a site your household visits often, nor a name that already has a rule. Each one is listed on the card, becomes a rule marked Blocked automatically (learning) in My rules, and an alert names them. Undo (or removing the rule) lets it through again, and that name is never blocked automatically again. If the level goes back below High, the card says On, but paused, and nothing more is blocked on its own.

Your rules#

My rules holds the names you blocked or allowed yourself. They come before the downloaded lists. A rule covers the name and everything under it: blocking example.com blocks ads.example.com too.

For the used to it, a rule written between two slashes is a regular expression, tested on the whole name: /^ads?[0-9]*\./ blocks ads.example.com, ad1.example.com…, and /(^|\.)casino/ every name with a part that starts with casino. It is marked regex in the list. Allowing always wins, then names before expressions; capitals do not matter; an expression that matches every site is refused, to allow as to block.

A rule can also be for one device only: on the form, choose the device under For. The rule of a device comes before the lists and the rules of the whole network, for that device only: a name the network blocks can be allowed on the TV, or the reverse. An allow rule of a device also lets through a service blocked on Services and safe search; the hours of Internet still apply. The list shows the name of the device next to its rules, and "until …" for a rule given for a while (an approved unblock request).

The Company baseline rules (Warda Business, open to everyone until subscriptions open) block, for the adults and the devices given to nobody, adult content, gambling, piracy, hate and the ways around the filter, and for everyone the mining pools (which Block the mining pools, chapter 4, blocks anyway in every plan). They are given by themselves when the plan becomes Warda Business, or with Give the baseline rules on their card in My rules; each one is then an ordinary rule, marked Company baseline rule, that you can remove, and a name you already decided on keeps your rule.

Dashboard and reports#

The Dashboard shows the state of the protection, the activity and what is blocked; Customize adds, removes or moves its modules. From Household, See the report details the activity of a child or a teenager over the chosen period. On the activity chart, point at a bar to see its queries (every 10 minutes over the last 24 hours); a click opens them in the query log.

The activity chart also marks what happened to the box, at its time: a diamond for an alert, a triangle for an update installed, a disc for a restart of Warda and a square for a start of the box (a restart within 10 minutes after an update or a start is shown with it). Point at a mark for its details; a bar chosen lists its events under the chart, and an alert leads to Alerts. A sudden change in the activity then explains itself. The marks show for every period but Real time (5 min); the alerts show to the accounts that read the reports, with the subscription (open to all until subscriptions open). Two more marks: a triangle upside down when Lists updated (the lists of Warda that changed, named when you point at it), and a hexagon for an alert of a Monitored category (the category and the person; a click opens Alerts).

From Warda 0.7.10 the mark of a restart says why Warda restarted, when it is known: an update, a restart asked from the interface (the button, or a setting that needs it), the certificate of the encrypted DNS that arrived, a backup restored, a power cut, a stop nobody asked for. Every start is also written in Administration → Activity log (action service.start, with its reason). And a restart no longer empties what you see: the counts, the charts and the last analysis of the learning are the same after it (what can still be lost: chapter 6, Maintenance).

For the administrators, small badges under the state of the protection show the options of the DNS services turned on (DNSSEC, encrypted DNS, limit of queries, answer to blocked names); a click opens Network → DNS services.

The network live (in the card of the protection, for the accounts that read the reports) shows the 7 last names asked, every 3 seconds, with their device, their person and whether they were blocked and why; Pause stops it to read it. The 7 lines are fixed. Its counter "… queries in the last minute" counts among the last 100 names, so it stops at 100 on a busy network.

Sensitive categories shows the sites of the monitored categories of the last 7 days, by person and category. It fills only when a device is given to a child or a teenager, and a category is set to Monitor for that profile in Protection settings (by default: piracy and social networks for a child, violence and drugs for a teenager), and nothing else blocked the site first. Adults are never monitored: without a child or a teenager, the card stays empty. Without the subscription (once subscriptions open), the card says the alerts come with it.

Exposure on the Internet (a card of the dashboard; add it with Customize if your dashboard was customized before) gives the last check of what your network exposes on the Internet and the findings by severity, with a link to the page.

From Warda 0.7.11, the Services of the box card ends with the line Base list, which gives two figures, such as "605,224 domains blocked, covering 731,487 names of the source lists" for the lists built on October 31, 2026 (yours may differ a little: the lists change every night). The first is what Warda holds: one entry per domain, and an entry also blocks every subdomain under it. The second is the number of names in the lists Warda is built from, counted one by one. Other tools (Pi-hole, AdGuard Home) keep one line per name and show that count: their counter is larger for the same names blocked. Compare it with the second figure, never with the first: a smaller counter does not mean less protection. The small line under it gives the day the list was built (the lists of Warda are built again every night) and the last time your box checked (every hour). As long as the box has not received a list that carries these figures, the line reads as before: "… domains, updated …".

You do not have to wait for the next check: the button Update the lists now, under the line Base list (and in the card Updating the lists of Protection settings, with the day the list was built and the last check), checks at once the base list and the lists of the categories in use. The button turns into "Updating…", then tells "Lists up to date" (a list changed and is applied), "Already up to date" (nothing new since the last check) or "Failed: …" with the reason (the box keeps its previous lists). One update runs at a time, and the button waits a minute before the next one, so as not to overload the servers of the lists. It is for the administrators who change the system, and each update is written in the administration log. With two boxes in high availability, the button updates the box whose page you are on; the other box keeps its own schedule.

Reports → Query log lists the last names asked, newest first: search a name, keep only the blocked ones or one device, or follow them live. Click a name for its details; Block or Allow makes it a rule for the whole network. The devices of adults who did not agree to reports never show there.

The Person / group column gives the person of each device, or its group when it belongs to nobody in particular; the filter of the same name keeps one person or one group.

Unknown local name is not an error. A device asked for a name of your local network (a single word such as nas, a name in .lan, .home or .internal, the reverse lookup of a private address) that no device of your network has. Warda answers "not found" itself and never sends such names to the Internet: they would tell outsiders what is in your home. Point at the reason, or open the row, for this explanation (and see chapter 7 if your box knows that name).

The Reports menu (administrators) details the queries (types, cache, reasons of blocking, activity by hour), the domains most allowed and blocked, the most active or silent devices, the countries of the sites visited and the upstream servers. In Queries, the Activity by hour goes from green for the quiet hours, through orange, to red for the busiest hours of the period; an hour without any query stays empty. The reasons of blocking and the types of queries are drawn as bars, the upstream servers as a ring.

The half rings. Each of the four figures at the top of Queries, Domains, Devices and Internet has a half ring: under Queries, the devices that asked something out of the devices known; under Blocked, the share of the queries blocked; under Answered from the cache, the share of the answers from the cache; under Average time, the speed of the answers (Fast under 50 ms, Good under 150 ms, Slow beyond; full at 200 ms). In Devices, Types of queries by device shows what each of the most active devices asks (A, AAAA, HTTPS…, the rarest under Others), never for the device of an adult who did not agree to detailed reports. In Internet, the Map of the countries colours the 15 countries of the list in five shades (a small country gets a dot), the others stay white; the map is drawn on the box (Natural Earth, public domain), nothing is loaded from elsewhere. Everything is computed on the box and nothing is sent anywhere. The identifier of your installation (WRD-FR-1234-ABCD-EFGH) is at the bottom of the Services of the box card of the dashboard: give it to the support if you ask for help.

Reports → Look-alike names (free) lists the names made to be mistaken for known ones that your devices asked, one line per name: the name it imitates, its kind (other letters, typing mistake…), what Warda did (Blocked or Told), how many queries, on how many devices, the first and the last time; sort it by Queries, Devices or Most recent. Reports → Security (subscription) counts the threats stopped over the last 7 or 30 days. Both run up to now, today included: a threat of this morning shows at once.

The reports are grouped by theme in the menu: Activity, Family, Security and Company. Network → Network map shows your network simply: the box of the Internet, the switches and the Wi-Fi access points, and under each the devices plugged in by cable or connected by Wi-Fi. What Warda guesses is drawn dashed: click a device (or Correct on an access point) to say what it is and where it is connected; it is kept. The Plan draws it as a diagram (the List stays one click away); with a managed switch, give its SNMP community (read only) with Correct: Warda then reads which device is on each port, and which access point each Wi-Fi device uses. The whole plan fits in the page, on a phone as on a computer, without scrolling.

The date at the top of the dashboard shows the time too, and the figures of Protection are laid out two by two, centred in their cells, each with its icon: a magnifier for the queries, a shield with a cross for those blocked, a laptop and a phone for the active devices, a light bulb for the suggestions waiting. After a restart, Online services shows at once, with the time of each check ("checked 3 minutes ago").

The Health of the box card follows the box live. Its bars change colour with the use: green up to 70 %, orange up to 85 %, red above, black when full; the memory and the storage show their percentage, and the temperature is measured against 85 °C. The charts of the load and of the network sit in a frame. Above the Processor, the chart of the Load shows the last hour (averages over 1, 5 and 15 minutes). After the Storage, the Network block gives what the box receives and sends right now (Received, Sent), its chart over the last hour and the totals since it started. When Warda runs in Docker on a network of its own, only its own traffic is counted: the card says so.

Online services gives each encrypted DNS a line of its own: DNS over TLS (DoT), DNS over HTTPS (DoH) and DNS over QUIC (DoQ), each with its state (Answering or Not answering, with the error) and the time of its last check. The box checks itself: a firewall between your devices and the box does not show here (see chapter 9 if a device cannot reach it).

The reports Queries, Domains, Devices and Internet open at once when one was already made. When it is more than 5 minutes old, Warda computes a newer one in the background and says "A newer one is being computed." until it replaces it.

Reports → Security explains what is normal under each figure (a few threats a week is common; a bypass is expected at 0 at home) and what the chart by day means, and leads to the action: See the devices, Open the alerts, Adjust the protections, Block the ways around the filter, or the quarantine of a device from its row. On Look-alike names, It is not an imitation is a button on the row of each name.

Every account opens the query log. A member only sees their own devices there: those of their person, those of the groups they made, and the device they are using; the page says so ("Only your devices show here…"). The administrators see the whole network, their own devices included.

Long lists are shown by pages: scheduled tasks, devices, rules, alerts, the query log, reports, the activity log… 50 lines per page by default; Lines per page offers 10, 25, 50, 75 or 100, remembered for each list in this browser. The pages show only above 10 lines, with First page, Previous, Next, Last page and "Lines 1–50 of 1,234". In the list of Devices, one line out of two is lightly shaded, so that the eye follows a line more easily. On Administration → Activity log, the search and the filter by author cover the whole log, not only the page shown.

The Query log is read page by page from the box, its filters covering the whole journal; going past the first page turns Live off, which shows the newest names.

On the Network map, each machine has the colour and the icon of its kind (this box, devices of people, TVs, printers, cameras, connected objects…), the box of the Internet stands out, and the links are coloured by type, grey when the machine was not seen lately: the Legend under the map explains them.

Alerts and time spent#

Protection → Alerts gathers what deserves a look: a child who tried a VPN, a proxy or an encrypted DNS service (blocked), a device used during a cut that went silent (switched off, or on another network?), a new device on your network, and the sites of the monitored categories. The dashboard says how many are new. Adults are never watched: when an adult's device leaves Warda, only that adult sees it, in My account.

Decide on an alert. Under each alert, choose:

• Accept the risk: Warda makes the allow that fits it (the site allowed for that device, or for the whole network, the exposure marked as known…), after a message that says what will change;
• Refuse the risk: Warda makes the block that fits it (the site blocked for that device or for the network, or the device in quarantine);
• Keep watching: nothing changes, and the alert is told again at most every 14 days while its cause is still there;
• Read, for the alerts no rule answers (a device gone silent, a data breach…).

Each decision marks the alert read, shows its date and who took it ("Risk accepted on … by …"), goes to the activity log, and Undo puts back what it changed (unless someone changed it since). A new device or an unusual day is told once: it can be accepted (the device kept) or refused (the device in quarantine), not watched. Accepting or refusing needs the right to change the devices, the rules or the network, depending on what changes.

From Warda 0.8.0 the group Security also gathers: a port of your home that answers from the Internet (Exposure on the Internet, below), an e-mail address of the household found in a data breach, a device that contacted a mining pool, a connected object in restricted mode that asked a name outside its list, and the trackers Warda blocked on its own. The group Bypass adds two notices for the enrolled devices of the children: mobile data at home, and a probable connection sharing (chapter 8).

Reports → Time spent estimates how long each child, each teenager and each adult who agreed to detailed reports spends on Internet: by day, by hour, by site and by device.

A child who wants more time opens http://warda/ask on their device and asks 15, 30 or 60 minutes: you accept or refuse in one click from the dashboard or Alerts. Reports → Summary of the week gives the week of each child and teenager, and of each adult who agreed to detailed reports, in a glance. Every Monday morning Warda keeps the summary of the week that ended: Week shows the 52 last ones. To receive it by e-mail, set the mail server of the box first (chapter 6, Settings), then tick Send the summary of the week that ended every Monday morning and add each Recipient (an administrator or an adult of the household, with an E-mail address and a Language). It goes from your box to your mail server only, never through the online service of Warda; Send last week’s now sends it at once. An adult who withdraws their agreement, or a person removed, leaves the past summaries too.

Notifications#

From Warda 0.8.8, the alerts of Warda also reach your phones and computers, like those of an app. The texts stay general ("New device", "Threat blocked"…): the details are visible only after signing in to Warda. Tapping a notification opens the page of Warda it is about.

Each adult sets their own in My account, card Notifications: their devices, their alerts and their quiet hours. Their choices concern only them: the other adults make their own. In Administration → Access to Warda, the administrators see how many devices receive the notifications of each account. Once, Warda also offers them at the top of the page: Turn on notifications or Later.

First of all. Notifications need the box to have its Warda name and its certificate: an administrator sets them in Network → DNS services (encrypted DNS, chapter 3). Until then, the card says so. A device subscribes only at the secure address of Warda (its name, in https://): anywhere else, the card gives the link. The notifications go through the online service of Warda; with two boxes in a pair, they are set on the primary. While an account receives them, Warda lets the notification services of Apple, Google, Mozilla and Microsoft through by itself (a rule Notifications, not editable).

My alerts. A switch at the end of each line:

• Box offline: your box has not responded for 15 minutes;
• Box back online: it responds again after a cut;
• Update available: a new version of Warda, once per version (administrators only);
• Protection lists not updated: the lists could not be updated for 3 days (administrators only);
• Bypass detected ★: a device of a child or a teen bypasses the protection (VPN, another DNS…); for your own device, only you are told;
• New device ★: an unknown device joined your network;
• Threat blocked ★: phishing or malware blocked; grouped, once an hour at most;
• Sensitive category ★: a child's device tried to open a monitored category;
• Data leak through DNS ★: a device sent data out through domain names;
• Summary of the week ★: the summary of the week is ready, on Monday morning.

★: included in the subscription (open to all until subscriptions open). All are on by default, except Box offline, Box back online and Summary of the week. For the first two, Warda first explains what changes: your box sends a signal to Warda every 5 minutes, with only its identifier, the time and its version. Nothing about your sites, your devices or your household, and the box does not become reachable from the Internet. The signal stops as soon as no adult wants these alerts any more.

Quiet hours. During these hours (22:00 to 07:00 by default), your alerts wait and arrive grouped at the end. The same Start and End: no quiet hours. Let “box offline” through the quiet hours makes an exception for that alert.

Android (Chrome).

1. Open Warda in Chrome, at its secure address, then My account.
2. Tap Turn on notifications on this device.
3. Android then shows its own windows, one after the other: Chrome asks to allow notifications for the site, then Android may ask to allow notifications for Chrome. They look like the prompts of ads and spam, but accept them all: otherwise, nothing arrives.
4. The device appears under My devices, marked this device.

Refused by mistake? In Chrome: ⋮ → Settings → Site settings → Notifications, and allow Warda. In Android: Settings → Apps → Chrome → Notifications, and turn them on. Then tap the button in My account again.

iPhone and iPad (iOS 16.4 or later). A web page receives notifications only once it is added to the Home Screen:

1. Open Warda in Safari, at its secure address.
2. Tap Share, then Add to Home Screen.
3. Open Warda from that new icon, not from Safari.
4. My account → Turn on notifications on this device, then Allow.

iOS shows the notification under the name Warda, followed by the name of the site ("from warda"). iOS adds it: Warda cannot remove it.

Computer (Chrome, Edge, Firefox). Open Warda at its secure address, My account → Turn on notifications on this device, and choose Allow when the browser asks. To change your mind, on Firefox as on the others: the padlock left of the address, then notifications.

Try it. Send a test notification (as soon as a device is subscribed): it arrives within seconds on your devices. Under each device, Warda shows the last notification received. Remove stops the notifications on a device.

Nothing arrives? Check, in this order:

• the permission: if it was refused, the card says that notifications are blocked for Warda in this browser; allow them (see above), then try again;
• the device: asleep or saving power, a phone can delay notifications; on Android, leave Chrome without a battery restriction; Focus or Do Not Disturb hides them too;
• the box: its name and its certificate in Network → DNS services, and Warda opened at its secure address;
• the quiet hours: during these hours, the alerts wait for the end;
• on iPhone and iPad: Warda opened from the Home Screen icon, and Settings → Notifications → Warda allowed.

Trends and unusual days#

Reports → Trends (subscription, open to everyone until subscriptions open) compares the last 7 or 30 days with the ones before: the queries, those blocked and their share, the active devices, day by day, what blocked, the devices whose habits changed and the new names. Each of its four figures has a half ring: this period against the one before (a tick marks the period before), the share blocked, the active devices out of those known.

Unusual days. For each device, Warda compares each day with the same day of the week over the last 8 weeks. A day is unusual when the device asked at least twice as much as usual, or at most a third, far beyond its usual variation, with at least 200 queries. A device needs three weeks of habits first, and a day without any query is never one (see the silent devices). Only the numbers are used, never the names. The page lists the unusual days of the period (Far more than usual, Far fewer than usual, with the usual number for that day) and marks them under the chart of the days. Each unusual day also raises one alert: far more can be a new program, an update or a device that behaves differently; far fewer, a device little used that day, or one that asks another DNS. From the alert, Accept the risk keeps the device as it is, Refuse the risk puts it in quarantine.

Exposure on the Internet#

A camera, a NAS or a router that answers from the Internet is the usual way in for attackers and botnets. Network → Exposure on the Internet (from Warda 0.8.0, free) shows what of your home can be reached from outside. Warda checks once a week by itself, when your router changes, and when you press Check now (at most every 2 minutes; the online service accepts six checks a day).

The page looks at three things:

• Port mappings of the router (UPnP): the ports your router opened by itself because a device asked it to (a console, a camera, a NAS), with that device and the name it gave. Warda reads this list from the router of your network, and only from it.
• Seen from the Internet: the online service of Warda connects back to your public address, and to no other, on a list of risky ports (remote access, file sharing, cameras, databases, administration of a router, from Warda 0.8.0 DNS…) and on the ports of the mappings. It only opens a connection, sends nothing, and keeps no address. This part needs the terms of use of the online service accepted.
• Telnet and FTP on your network: the machines present that accept these old ways in, which send everything unencrypted.

What the findings mean. What is exposed gives each finding a level: Critical (a way in attacked all day long: telnet, file sharing, remote desktop, a database, a video recorder), High (SSH, the administration of a NAS or of a router, the stream of a camera, a web page of a device that is not a server), Medium or Information (UPnP on, a port of a game). Each one comes with its advice in plain words. A new finding raises one alert, never again the following weeks; I know, do not alert again puts aside a finding you meant (a server you published on purpose), Alert again brings it back.

Findings that expire. A finding stays in the list while a check found it in the last 7 days ("last found on …"). Not found again for 7 days, it moves to the History, with when it was first and last found and when it expired: coming back after weeks, you see what is open now, not what was closed long ago. Found again, it comes back to the list and raises a new alert. The dashboard can show a card Exposure on the Internet: the last check and the findings by severity.

Closing a port, depending on the finding:

1. A mapping made by UPnP: turn the remote access off in the device (camera, NAS), or turn UPnP off in the router if no console or application needs it: the devices can then no longer open ports by themselves.
2. A port forwarding made by hand (called NAT, port forwarding or virtual server in the router): remove it. To reach a device from outside, use a VPN rather than an open port.
3. No forwarding, and still open: the router answers itself; turn off its remote administration.
4. Change the factory password of the device and update its firmware, then Check now.

What it cannot see: the services that use UDP (listed only when the router forwards them by UPnP); over IPv6, the ports the router opens for each device (only the address of the Warda box is tried: keep the IPv6 firewall of the router on); the mappings of a router without UPnP (the check from outside still sees what answers at your address). Behind the shared address of some 4G, 5G or fibre offers, the public address belongs to the provider and cannot be checked.

Data breaches and passwords#

When a site where you have an account is hacked, its accounts end up published, and attackers try the leaked passwords everywhere else. Protection → Data breaches (from Warda 0.8.0) has two parts.

Addresses watched (subscription, open to everyone until subscriptions open). Type an e-mail address as you use it to sign in, choose the Person of the household if you wish, then Watch (20 addresses at most). Warda checks it within a minute, then once a week; Check now once a day per address. Each address shows No known breach, or the sites whose leaks contain it, with the date found. A member sees on this page only the addresses linked to their own person.

How the address stays private: Warda computes a fingerprint of it and sends only its first 6 characters, through the online service of Warda, to Have I Been Pwned, which answers with every address whose fingerprint starts the same way (hundreds of them). Warda looks for its own at home: neither service can tell which address you watch.

Not open yet. While the page says The breach service of Warda is not open yet, nothing is checked: your addresses are kept and checked within a day of the opening. The password test already works.

After an alert ("… is in a data breach: …"; one alert per new breach):

1. Change the password of that site, and of every site where you used the same one.
2. Turn on two-step verification wherever you can.
3. Beware of e-mails and messages that use the leaked data to look genuine.

Stop watching forgets the address, its breaches and its alerts.

Test a password (free, every account). Type it in Password to test, then Test: Warda tells how many times it was seen in leaks (stop using it), or that it is not in the known leaks, which alone does not make it strong. The password never leaves your browser: the browser computes its fingerprint and gives the box only the first 5 characters; the box asks Pwned Passwords for every leaked password that starts the same way, and the comparison is made in your browser. Nothing is kept, and the field is emptied after each test. If the browser offers to suggest or save a password in this field, ignore it.

The data comes from Have I Been Pwned (Troy Hunt), under the licence CC BY 4.0: the page credits it at the bottom.

Warda Business: data leaks and unblock requests#

Data loss prevention. In Business → Data loss prevention, a company chooses what happens with the services through which its data can leave it: File transfers, Personal storage, Mixed storage, Paste sites, Anonymous file hosts, Personal webmail and AI assistants (WeTransfer, Dropbox, Pastebin, Gmail, ChatGPT…). Warda sees which device contacts which service, never what is sent.

• On the Policy tab, choose for each channel Allow, Tell (the name passes and is recorded) or Block, for the whole network, a group, a person or a device: the most precise choice wins. By default, everything is allowed. Mixed storage (Google Drive, OneDrive, iCloud Drive) can only be told: its names serve work and personal accounts alike.
• A service the company uses itself (its own storage, its mail) is allowed with a rule in My rules: the rules come before the policy.
• The Report tab counts what was blocked and told today, over 7 or 30 days, by channel, by device and by person, with the last events (kept 90 days). Each event is also in Alerts, once a day, and in the SIEM export when chosen.
• The policy applies to every device of the company: inform the employees first. The tab Inform the employees gives the legal points and a text to adapt.

Unblock requests. When a name someone needs is blocked on their device (by the policy, a category, a service, a rule…):

1. They open the menu of their account (their initial, at the top right) → Ask to unblock: Blocked lately on your devices lists the names blocked in the last 24 hours, with what blocked them.
2. They pick a name of that list (Ask to unblock: only a name blocked on that device in the last 24 hours can be asked), choose the duration (For: 15, 30, 45 or 60 minutes, or for good), answer Why do you need it?, then Send the request.
3. The administrators see it on the dashboard (Unblock requests waiting) and in Business → Unblock requests, and Approve or Refuse it, with a comment if they wish.
4. Approved, the name opens for that device only, for the time asked (then it is blocked again by itself) or for good. The answer and the comment show under My requests.

One request waits at a time per device and name, 10 a day per account; a request left without an answer expires after 7 days. The protections against threats, the illegal content and the hours of Internet of a child cannot be requested. Every request and every answer is written in the log.

A request can also be sent from the page "Blocked by Warda" itself, without an account: it shows as Someone on the block page, with the device, and the limit of 10 a day applies to each device.

Unblock for 15 minutes from the block page (off by default). On Business → Unblock requests, the card Unblock for 15 minutes from the block page lets the person in front of a blocked site open it for 15 minutes on their own device, without waiting for you, after choosing why. Risk: anyone on the network can then open a blocked site for a while without asking you, so Warda asks you to confirm. Set Unblocks a day for one device (3 by default, 1 to 10) and Unblocks a day for the whole network (10 by default, 1 to 50). It never lifts a threat, the hours of a child, the illegal content, your own block rules, a suspicious domain, the data loss prevention, a connected object in restricted mode, nor a VPN or proxy (once installed, it would get around the filter for good): a request stays possible for those. Each unblock goes to the activity log, raises an alert, and shows in the history as Unblocked automatically, with the reason chosen.

Warda Business: security center, AI services and policies#

Every page of Warda Business works (open to every installation until subscriptions open).

Security center. In Business → Security center, a Security score out of 100 sums up the security of the company: good from 85, fair from 60, poor below. Under it, the Actions by priority: devices in quarantine, threats found, data leaks, devices that go around the filter or are given to nobody, administrators without a second step, an update waiting, backups missing, protections off… Each costs points and has Open, the page that settles it. The Trend shows the score and the alerts of each day over 7 or 30 days.

AI services. In Business → AI services, the Use tab shows which AI assistants (ChatGPT, Claude, Copilot, Gemini, DeepSeek…) are used, on which devices and how often, and warns about those used for the first time this week. The Policy tab chooses Allow, Tell or Block for all the assistants, for the network, a group, a person or a device (the same setting as the channel AI assistants of the data loss prevention), and blocks an assistant on its own if you wish: ChatGPT allowed, DeepSeek blocked. Warda sees which device contacts which assistant, never what is sent. Like the data loss prevention, this page and the company reports are the company policy: they cover every device of the company, adults included, whatever the reports each one chose; inform the employees (a template is in the tab Inform the employees of the data loss prevention).

Device policies. In Business → Device policies, a table gives for each kind of device (the groups: servers, TVs, printers, cameras, connected objects…) its protections, its blocked services and its data loss prevention; Change a policy changes one, applied at once. A new device goes into the group it looks like within ten minutes and gets its policy. Compliance lists the devices that escape a policy: given to nobody, not recognised, not asking Warda, trying the ways around the filter, in quarantine.

Users of the directory. In Business → Users of the directory, give the address of your Active Directory or LDAP directory (ldaps://, or ldap:// with StartTLS: never in clear), an account that may only read it and where the people are. Test the connection, then Import now: each person of the directory becomes a person of Warda, imported again every hour. Nothing is written to the directory, and nobody is removed without you. A group of the directory can be given a group of devices: the devices of its people then follow its policy.

Sign-in to Warda (from Warda 0.8.2). On the same page, the card Sign-in to Warda lets the people of the directory sign in with their usual password of the company, or with Sign in with Microsoft (Microsoft Entra ID) or Sign in with Google (Google Workspace). Their account is made at their first sign-in and has no password in Warda: they change it at the company. Under Rights of the groups, give a group of the directory a group of accounts: its people get those rights at each sign-in (the group of the administrators makes administrators; without a group, a person signs in as a Member, or is refused when Only the people of a group given below may sign in is on). You can only give rights you have yourself. A person disabled in the directory can no longer sign in, and is signed out at the next import. The accounts of Warda, and first the emergency account admin, keep signing in with their own password, even when the directory does not answer: keep that password safe. A person who signs in only with Microsoft or Google cannot change the accounts (Warda cannot ask their password again).

• Password of the directory: with the directory set above, tick Sign in with the password of the directory, then Save.
• Microsoft Entra ID: Warda needs a public name first (Network → DNS services, a certificate given by Warda). In the Entra admin center, register an application (App registrations → New registration, single tenant, platform Web with the Redirect URI to register that Warda shows), then copy its Directory (tenant) ID, its Application (client) ID and a new client secret (its Value) into Tenant ID, Client ID and Client secret. To import the people too, give it the application permissions User.Read.All and GroupMember.Read.All with the consent of an administrator, and tick Import the people of Entra ID every hour. Tick Show “Sign in with Microsoft” and Save.
• Google Workspace: in the Google Cloud console, an internal consent screen and an OAuth client of the type Web application with the redirect URI that Warda shows; copy its Client ID and Client secret into Warda and type your Domain. To import the people too, a service account with a JSON key and the domain-wide delegation of the read-only scopes for users and groups (Google Admin console), then Key of the service account (JSON) and Administrator of the domain. Tick Show “Sign in with Google” and Save.

Saving asks your password again. Every step, with the exact menus of Microsoft and Google, is in the technical reference.

Company reports. Reports → Company reports sums up the week or the month for the management, ready to print: queries, security score, alerts, data loss prevention, AI services, by person and by kind of device. It opens at once: Warda computes it in the background every hour, and the page says when ("Figures of 14:00, computed again every hour."), so today's figures can be up to an hour behind. Compute now brings them up to date (accounts that can change the reports, at most once a minute). After renaming a person or giving a device to someone else, the report shows it at the next hourly computation, after midnight, or with Compute now. Its four figures have their half ring: the security score out of 100, the active devices out of those known, the share blocked, and the leaks blocked out of those seen.

Company logo. In Business → Company logo, Add a logo: a PNG, JPEG or WebP image (never SVG), 256 KB and 4096 pixels a side at most, 4 million pixels in all at most. Warda draws it again on the box, without its metadata (place, camera, author), reduced to fit 640 × 320 pixels, then Save the logo. It shows on the company reports (and their print), on the page "Blocked by Warda" and on the page Ask to unblock, always loaded from the box itself. It is in the backups and goes to the second box of a pair; Remove the logo brings the Warda shield back.

Warda Business: high availability#

Two Warda boxes can share one address: the devices use it as their DNS server, and when one box stops, the other answers within seconds. Both boxes need a fixed IPv4 address on the same network, and the shared address must be free, outside the range of your DHCP server.

1. On the first box (the primary): Business → High availability → Make a pairing code. The code WH-… is valid 15 minutes.
2. On the second box: Join a pair, type the Address of the primary and the Pairing code, then Join (the field shows an example address taken from your own network, and what is wrong in the form is told in your language). Its configuration, accounts included, is replaced by the one of the primary, which it copies every minute from then on.
3. On the primary, type the Shared address: the address alone (192.168.1.2) or with the length of its network (192.168.1.2/24). Alone, Warda takes the length of the network of the box; the field shows an example taken from your own network, and a refusal is told in your language (from Warda 0.7.10; before, the length was required). Keep the Virtual router offered unless another device of your network already uses VRRP.
4. Give the shared address to your devices as DNS server, in the DHCP server of your box or router (or of Warda).

Installed with the package or the Raspberry Pi image, Warda sets up keepalived (the program that moves the address) by itself. With Docker, run keepalived in its own container: the example is in packaging/docker-compose.yml. The page shows which box holds the address, the last synchronisation and the other box; Make this box primary swaps the roles (the DHCP server of Warda, when it runs, moves to the new primary), End the pair separates them. Make your changes on the primary: those made on the secondary are replaced. To know before you look at the secondary: each time the configuration of the primary changes, the secondary applies it by restarting, and its own journal and statistics keep their last 48 hours, for the devices the primary knows; what is older is deleted.

Protection outside the home in a pair (from Warda 0.8.2, both boxes on 0.8.2). The secondary receives the protected devices from the primary and waits (its page Outside the home says “Standby: …”). When the primary is down, the secondary takes over under the name of the primary, within about a minute (a few minutes without keepalived), so the devices stay filtered; when the primary is back, it takes the relay back. Give and remove the addresses on the primary. End the pair on both boxes: a box that still believes it is in a pair goes on taking the relay every 10 minutes. After the end of the pair, only the box whose name the addresses carry serves them: on the other one, give the devices new addresses.

Warda Business: sites#

A company with several sites sees all its Warda boxes from one of them, through the online service of Warda: no port to open.

1. On the box of the head office: Business → Sites → Create an organisation, with the Name of this site. It becomes the manager and gets a code WS-…, valid 24 hours for one box (Make a new code for the next one).
2. On the box of each other site: Join an organisation, with the Code and the name of its site.

Every 15 minutes, each box sends its state: health, version, queries and blocks of the last 24 hours, alerts open, devices, protection, updates. Only counts: never a site visited, a device or a person. The manager sees every site in a table and can Remove one; a site can Leave the organisation. If a box refuses to join because the online service still counts it in an organisation (a backup made before it joined was restored), Leave it, then join settles it. 50 sites at most per organisation until subscriptions open. Coming next: the rules and policies of the company given to every site, every site updated at once, and the reports of every site gathered.