4. First steps

The household#

In Household → People, add each person with their profile: child, teenager or adult. For a child or a teenager, give the month of birth: the profile then follows the age by itself (teenager at 15, adult at 18); it is never asked for an adult. Then drag each device (or choose it in the list) to the person who uses it. The machines found on the network that do not use Warda yet are there too. What a device did only shows for a person from the moment it is given to them.

• Detailed reports exist for children and teenagers.
• An adult has a detailed report only if they accept it themselves, from My account, after an administrator offered to link their account to their person.
• Without that agreement, the adult still counts in every total and chart (queries, activity, devices, reports): only the names they visit stay hidden.

A device shared by several people (from Warda 0.7.10). The tablet of the family, the computer of the living room: in Household → Devices, click Share… on the device, tick the People who use this device, then save (or, on the card of a person, Share a device…). Nobody tells Warda who is using it: for each rule, the device follows the most protective one among its people — categories, safe search, blocked services, hours of Internet, time a day. The page says so: "Shared by Anna, Tom — follows the rules of the child profile, the most protective."

• An adult who shares a device with a child is cut with the child on that device: same hours, same blocked categories, same time a day. Their own devices are not.
• The shared device has its own time counter: the time used on it is counted for the device alone, against the smallest time among its people, never in the time of one of them. A child with one hour of games a day has that hour on their own devices, and the shared device has its own: a child who used up the time on their own device has the allowance again on each shared device, and the minutes you give the child extend both.
• Its activity is in nobody's report: it is listed apart, under Shared devices.
• Its detail (the names asked) shows only when every adult who shares it agreed to detailed reports; otherwise only totals. A change of that agreement applies at once.
• With an adult among its people who did not agree, a category that is only monitored for the child is neither blocked nor recorded on the shared device: less supervision there than on the child's own device.
• No request for more time can be made from a shared device: the child asks from a device of their own, or asks you. An adult who shares the device and has an account can still ask to unblock a name for it (Ask to unblock); only an administrator can approve it.

Each card of People and of Groups has a soft colour of its own, always the same, to find it at a glance.

Warda gives each device its maker from the three registries of the IEEE (about 53,000 entries, the most precise first), downloaded again every day with the lists: a new maker is known without waiting for a new version of Warda, and the makers saved on your devices are named again. Network → Network analysis says which table names them and its date. A virtual machine or a container shows as such: Virtual machine (KVM/QEMU), Docker container, VirtualBox. A phone or a tablet with a private address (Wi-Fi setting on by default on iOS and Android) gives no maker (Private or virtual address stands in its place). Warda names it from what it tells the DHCP server of the box when it joins the network ("iPhone-of-Hubert"), or else from the system its questions show: iPhone or iPad, Mac, Apple device, Android phone with its maker (OnePlus, Samsung…), Windows computer, Linux computer. From Warda 0.7.10 the system is told from several clues added up, not from the first one: while Warda is not sure, it tells nothing (the device stays Private or virtual address) rather than guessing — before, an iPhone could be shown as an Android phone. Give it a name in Devices to keep it.

What each device is (from Warda 0.7.10). In Devices, the column Kind says what a device is: phone, tablet, computer, server, firewall / router, access point / switch, printer, TV / media box, game console, smart speaker, camera, connected object (IoT), NAS / storage, watch, or simply device. While you choose nothing, Warda proposes a kind (Automatic: …) from the name of the device, its maker and its system; a kind you choose is never replaced, and Automatic gives the choice back. The list can be filtered by kind. A kind changes the icon; four of them also change what Warda does: a server, a NAS, a firewall / router and an access point / switch work alone and make regular automatic calls, so once you choose one of these kinds, Warda never suggests blocking what they ask.

One device per machine. Your router may give a device a name with the domain of your network (pc.fritz.box) while the device calls itself pc, and phones and computers change their IPv6 address often. Warda keeps the names without the domain of the network, and every 5 minutes merges by itself the devices that are one machine (task One device per machine). A name many machines get out of the box (raspberrypi, iPhone, DESKTOP-…) is not enough to merge them. If a machine still shows twice, click Merge… on the device to keep in Devices, choose the other one in Same machine as, then Merge: the device kept keeps its name, its place and its rules, and gets the history of the other. Two devices given to different people or groups are never merged: place them the same way first. Network → Network analysis also recognises a machine by its address: a machine that uses Warda no longer stays at Not yet.

Groups of devices#

The devices that belong to nobody in particular go in a group of Household → Groups: Wi-Fi and network, NAS and home lab, TVs and consoles, printers, cameras, connected objects, guests (the devices of your friends on your Wi-Fi). Each group has its profile of protections. A device belongs to a person or to a group, never both.

• Warda puts the devices it recognises (printer, camera, TV…) in a group by itself; you can always move them.
• The default groups cannot be deleted. An administrator can make groups of their own: they are linked to their account and follow its protections, unless they choose others.
• The Warda box itself stays in Wi-Fi and network, shown with its address on your network: its own names are never filtered.

Restricted mode for connected objects#

A TV, a camera, a speaker or a smart plug only ever talks to a few servers of its maker. The restricted mode (free, every plan) keeps it to those: an object taken over by a botnet, which calls another server, is blocked, and you are told.

When to use it: for the objects that do one thing (cameras, TVs and media boxes, speakers, plugs, printers, sensors). Never for a phone, a tablet or a computer, which visit new sites every day: if a device in the mode starts to look like one, Devices warns you. It cannot be set for the device of an adult (or one shared with an adult): learning its names would record what that adult visits.

1. In Household → Devices, the card Restricted mode for connected objects lists the objects Warda recognised. Restricted mode for all connected objects starts the learning for all of them; or click Restricted mode on the row of one device, then Start learning.
2. The learning lasts 7 days by default (Learning period: 1 to 30 days). Warda records the names the object asks, reduced to the domain bought (example.com for cdn.example.com), and blocks nothing. The badge says Learning · 5 days left; Restrict now ends it early.
3. After the learning, the badge says Restricted mode: any other name is blocked, and an alert in Protection → Alerts (group Security) gives it, once a day per name, 20 names a day per device at most. An object that asks more than 500 different names is not a simple object: its learning stops by itself, and you are told.

The names of your home (local names, .lan, the records of Local DNS) and those of Warda are never blocked.

Allowing a name. In the alert, or under Names blocked lately in the panel of the device: Allow for this device, or Allow for all objects (a time server shared by several makers, for example; the list is on the card, Names allowed for all objects). Show the names lists what the device learned and what you added, Allow a name adds one, Export the list (JSON) saves it.

Firmware updates. After an update, an object may need a new name: it is blocked, and the alert says that an update may be the cause. Allow the name reported, pause the device with Something is broken during the update, or Learn again (the names learned are forgotten, those you added stay, and nothing is blocked while it learns). Turn off restricted mode gives the device back every name the filter allows.

Groups (made for Warda Business, open to every plan): in Household → Groups, each group has its line Restricted mode, marked Suggested for a group of connected objects on the groups of TVs, printers, cameras and connected objects. The devices of the group learn together, then keep to the names the group learned; a device placed in the group later gets them at once. A device with a mode of its own follows its own.

The limit: a program that uses its own DNS, or addresses written in it, goes around any filter by names, this one too.

Protection settings#

The Protection settings page (menu Protection; up to Warda 0.8.4 it was called Protections) sets, for each profile, what Warda does with each category: adult content, violence, hate and terrorism, drugs, gambling, piracy, social networks, videos, games, job sites, new domains.

• Block: the site does not open.
• Monitor (children and teenagers only): the site opens, and an alert shows on the dashboard and in the report.
• Allow: nothing special.

Security threats (scams, malware) are blocked for everyone by default; hate and terrorism for children and teenagers. Job sites are allowed for everyone: a business that wants them closed at work blocks them for the profile of the group of its workstations. Child sexual abuse material is always blocked, for everyone, and can never be allowed; but the lists of it are confidential and given only by an authorised body (such as the Internet Watch Foundation) to vetted organisations, and none is available to Warda yet: the category says so honestly, Always blocked — list from an authorised body: none loaded. A category marked "No list yet" has nothing to block for now.

Protection → Services and safe search blocks a service by its name (TikTok, Roblox, Netflix…) for the whole network, a profile, a group, a person or a device, and keeps the safe search of Google, Bing and DuckDuckGo and the restricted mode of YouTube: on for everyone by default, to turn off by profile.

On the Protection settings page, the card Data leaks through DNS (free, on by default) stops a program that hides data in the names it asks to send it out (a DNS tunnel): when a device asks many such names under one domain in a few minutes, that domain is blocked for that device for a day and an alert says so. Only the names are read, nothing is decrypted. Allow this domain lifts the block if it is a service you trust.

The card Look-alike names (free, on by default) blocks the names that imitate a bank or a known service with letters of another alphabet (“аpple.com” with a Cyrillic “а”), for every device, and tells you of the names one typing mistake away (“paypa1.com”). The sites your household visits most are protected too. It is not an imitation lets a name through if Warda is wrong. The names found, blocked or told, are in Reports → Look-alike names: one line per name, with how many times, which devices, the first and the last time.

The card Threats in the names (free) blocks the web pages that try to reach your equipment through a name of Internet (DNS rebinding) and the servers of the spyware, tells you when a device uses a remote access tool (AnyDesk, TeamViewer…, the tools of the fake support scams) or talks to a young domain at a very regular interval, and can put a device in quarantine: it then reaches only its updates and its antivirus (through Warda; to cut it off entirely, unplug it). If a spyware is found on your own device, you are told on your dashboard, even if someone else runs Warda.

On the same card, Block the mining pools (from Warda 0.8.0, every plan, on by default) blocks for every device the servers that collect the work of hidden cryptocurrency miners, and the miners that run in a web page. The sites of the exchanges and of the wallets are never blocked. A device that asks a pool is told once a day, under Found over the last 30 days and in Alerts: something may be mining on it for someone else (a program installed without you, a page left open). Put in quarantine isolates it while you check it. Something is broken does not lift this block; to mine on purpose, allow the name in My rules.

The card Reputation of the domains (from Warda 0.8.2, free, on by default) stops the traps that are on no list yet, such as a phishing site opened the same day. For a domain your household does not know well (on no list, not among the sites it visits most), Warda asks the analysis service of Warda for its opinion. Only the domain leaves the box (example.com, never the full name), never your device nor your browsing; without an answer within a moment, the name is answered as usual.

• A domain judged malicious is blocked for every device.
• Block the suspicious domains for the children and teenagers (on): for the adults, a suspicious domain is only told.
• Block for everyone the suspicious domains registered less than 14 days ago: almost every phishing site lives a few days, but being new is not enough, the analysis must also judge the domain suspicious. On by default. On a box installed before Warda 0.8.2, where it was off, an update after 0.8.4 turns it on once, unless an administrator had turned it off.

The domains found are listed on the card (Domains found over 30 days) and in Alerts; in the Query log their reason reads, for example, “Analysis of Warda: malicious (phishing)”. The very first visit of a site never seen may pass: the protection starts with the next queries. Something is broken does not open such a domain; if Warda is wrong, allow the name in My rules. The questions wait until an administrator accepts the terms of use in force (those of 2026-10-14), which list them.

Hours of Internet#

Household → Hours of Internet (with the subscription, open to everyone until subscriptions open, like the school holidays, the time a day and the Right now modes) gives each child and teenager the hours when they have Internet. Paint the week with the mouse or a finger (green: Internet, a line per quarter of an hour). Warda proposes hours for the age; nothing applies until you tick Apply these hours.

Rather use the keyboard? Under the grid, in Or type the hours, choose the days, a start and an end, then Open these hours (or Cut these hours).

After a change of the grid, press Save. The cut is not always instant: an application may keep an open connection for a while.

Outside the hours, everything is cut on their devices except the sites always permitted (school, homework), which you can add to. When they need a little more, press +15 min, +30 min or +60 min.

Under Time a day, give games, videos and social networks a time for each day: once used up, they stay blocked until midnight. School holidays: while During the school holidays, the hours of Saturday every day is on (the default), every day of the holidays, Sunday included, takes the hours of Saturday; turned off, the holidays keep the hours of the week.

For School holidays, choose your country, then your zone or region under Official calendar: Warda imports the coming year and keeps it up to date every week. The list shows the countries of the European Union covered by OpenHolidays, the source of the calendars. Where the holidays go by zone, the list Zone or region shows the School zones first, then the Regions (a region gives the holidays of its zone): Zone A, Zone B or Zone C in France, the north, centre and south in the Netherlands, the French, Flemish and German-speaking communities in Belgium. Only places are offered as zones: in Germany and Switzerland, the groups OpenHolidays gives are kinds of schools (primary, vocational…), not places, so they are not listed; choose your state or canton. Elsewhere, choose your region, as before.

Right now, the same page cuts Internet at once (30 minutes, an hour, or until the morning) or starts the homework mode for one or two hours: social networks, videos and games blocked, the rest open. Stop ends it.

A phone that leaves your Wi-Fi (mobile data, a friend's hotspot) escapes Warda, unless it is enrolled in the protection outside the home (chapter 11): its hours, its cuts and its protections then follow it. Lock it too with Family Link (Android) or Screen Time (iPhone, iPad).

When the subscription ends (once subscriptions open), the hours, the school holidays, the time a day and the Right now modes stop applying: Warda never keeps applying hours you can no longer change. They are kept, and apply again within a minute when the subscription comes back. A pause in progress can always be ended.

Accounts#

In Administration → Access to Warda, create an access for each adult who manages or uses Warda (or Give an access from their card in People), and choose its role (below). The admin account of the installation is the emergency account: it is always an administrator.

Each one can add a second sign-in step (authenticator app) from My account.

Roles#

In every plan, an account is one of two:

• Administrator: everything — the accounts, the system, the backups and their restore, the updates, and the password of the emergency account.
• Member: uses Warda (the dashboard, "Something is broken" on a device, their own account) and changes nothing for the others.

Choose it for each account on Access to Warda. Each person sees only the pages their rights open; a page they may only read says "Your rights let you see this page, not change it", and its buttons are off.

Warda Business: groups of accounts. A company often wants to hand over only part of the administration. In Business → Roles and groups, New group creates a group with the name you choose; tick its roles in a fixed catalogue: Full administration, Accounts and groups, Emergency account, Backups and restore, System and updates, Network, Everyday management, Reports and logs and Read-only. Then put accounts in it (from the group, or with Groups on Access to Warda). An account has the roles of all its groups, on top of the everyday use of a member. The page shows what each role allows and what each account may do.

• The group Administrators always exists and holds every role; its members are the administrators. It cannot be renamed nor removed, and at least one account always remains in it.
• You only give rights you have yourself, and you never change an account that has more rights than you.
• Without Warda Business (open to everyone until subscriptions open), the groups are ignored: each account is an administrator or a member.
• After the update from an earlier version, nobody loses a right: the former owners and administrators are administrators, the operators and auditors are members of the groups Everyday management and Read-only.

The emergency account. The admin account of the installation is the account of last resort: it can never be deleted, made a member or taken out of Administrators. Keep its password in a safe place; each of its sign-ins is shown on the dashboard. Only an administrator (or, with Warda Business, an account with the role Emergency account) resets its password or its second step; on the box, sudo warda reset-password admin.

Every change of role or group is written in the log.

On Roles and groups, each group is a row with its roles ("Roles: …") and its members, each with Remove. Add members lists the accounts you may add, Edit roles changes its roles and Delete the group removes it (never Administrators); each change asks your password again. An empty page says where to start: create a group, choose its roles, then add its members.

Learning#

For the first 7 days (and 48 hours for each new device), Warda observes without suggesting anything. Then it suggests trackers to block, with its reasons. The 7 days are days of Warda running: a box switched off observes nothing, so the period may last a little longer than a week of the calendar.

The Learning card of the dashboard follows this observation week ("Day 3 of 7": the day never passes the number of days). From Warda 0.7.10, when the week is over the card says so and tells what Warda studied — the names, the devices, the names it still watches, the suggestions made, or that nothing needed a suggestion — then leaves the dashboard a week later; the same figures stay on Suggestions. The learning goes on: its suggestions arrive in Suggestions, and Suggestions → Watched names shows what Warda is still watching (chapter 5).

Collective base#

Alone, a box only knows its own network. The collective base (subscription, open to everyone until subscriptions open) asks the analysis service of Warda for its opinion on the names your box doubts, and gives it in return the decisions of your administrators. It stays off until an administrator turns it on.

1. Open Protection → Collective base and read What is exchanged.
2. Turn on Exchange with the collective base (the terms of use must be accepted). The first exchange comes a few minutes later, then a few a day: every 6 hours, and at most once an hour when something waits. Exchange now makes one at once.

What is sent: domain names only, reduced to the domain bought (evil-shop.com for a.b.evil-shop.com): the suggestions your administrators accept or reject, and the names your box doubts (under observation, misleading names, young domains, beacons, unblock requests). Never a device, a person, a time, an address or your history; the online service of Warda does not give the identity of your box to the analysis service.

What comes back: the opinion of Warda on domains — clean, suspicious or malicious, with its reasons ("Opinion of Warda: suspicious — registered 3 days ago, listed by …"). It shows on the suggestions and under Watched names, and the page lists every opinion received. A dangerous name asked on your network in the last 7 days becomes a suggestion marked Collective base (5 a week at most): nothing is blocked until an administrator accepts it.

The dashboard card Collective base gives its state, the last send, the last opinions received and the counts of the week; while it is off, it offers Turn it on. Turning it off stops the exchanges at once.