For 7 days after installation, and 48 hours for each new device, Warda only
observes: warda status already shows the devices, what was blocked for
each one and how many suspicious names are under observation. Then, every
hour, it scores the names seen over the last 7 days:
- a keyword in the name (
telemetry,analytics,tracking… or, with other names of the same domain already blocked,stats,events…) is required; - calls in the background, at regular intervals, at night, or from several devices add confidence.
The level sets how many suggestions you get: low (fewest, most certain),
medium (default) or high. A domain you reject is never suggested again;
a suggestion you accept then unblock counts as an error of the scorer.
Your own domains (WARDA_OWN_DOMAINS), servers (warda device -kind server)
and a built-in list of vital services (system updates, banks, public
services, consoles, streaming…) are never suggested. A suggestion found on a
device of an adult who did not agree to detailed reports (or of a group
their account made) gives neither the device nor the site visited just
before ("private": true in GET /api/v1/suggestions).