Protection → My rules (GET /api/v1/rules,
PUT|DELETE /api/v1/rules/{domain}, administrators; warda allow,
warda block, warda unrule) always wins over the lists. A rule is a
domain, which covers its subdomains, or a regular expression written
between two slashes (the convention of AdGuard), tested on the whole name
asked (in lower case, without the final dot), without regard to case
(/Casino/ matches casino.com):
/^ads?[0-9]*\./blocksads.example.com,ad1.example.com…;/(^|\.)casino/blocks every name with a label that starts withcasino(casino.com,www.casinoroyal.fr).
The expressions use the syntax of Go (RE2): matching takes a time linear
in the length of the name, so no expression can slow the filter down (no
look-around, no back-reference). An expression is kept as written (\D
is not \d), 256 characters at most, 200 expressions at most; one that
matches the empty name, or every name of a set of probes (example.com,
a.b.c, xn--80ak6aa92e.com, warda-dns.com, wikipedia.org), is
refused, to allow as to block (an allowed /./ would turn the filter
off). In the path of the API, the slashes are escaped
(/api/v1/rules/%2F%5Eads%3F%5B0-9%5D*%5C.%2F). The order: allowing
always wins, then domains before expressions (allowed domains, allowed
expressions, blocked domains, blocked expressions), then the lists; the expressions of each side run as one alternation, and the rule
that matched (shown in the query log) is looked for only on a match.
WARDA_ALLOW and WARDA_BLOCK take expressions too, without a comma
(the lists of these variables are comma-separated). The company baseline rules
(see Plans) are personal rules with the origin business.
Rules of a device#
A rule can apply to one device only: For → the device, on the same
form (GET /api/v1/device-rules, PUT|DELETE /api/v1/devices/{id}/rules/{rule}
with {"action": "allow"|"block"}, administrators; table device_rules,
kept in the backups). Domains and expressions as
above, 500 rules and 20 expressions at most per device. A rule of the
device decides before the personal rules and the lists of the network,
CNAME targets included: a device can have a name blocked that the network
allows, or allowed that the network blocks. Like a personal allow, a
device allow opens the sensitive categories of its profile (never CSAM),
the services blocked on the page Services and safe search (every plan),
the channels of the data loss prevention and, from
0.8.0, a name outside the names of an object in restricted
mode; the
hours of Internet still apply. An allow of the device also lifts, for that
device, the protections an administrator's personal allow lifts (the
mining pools of 0.8.0 included): only an administrator gives it, since an
unblock request cannot ask for them. A rule of a device may end (until, set
by an approved unblock request for a while: the page
of the rules shows "until …", and a task removes it on time, restarts
included). The device of
a query is found from its address, as for the profiles. The query log shows
the origin device:<rule>; the page of the rules lists these rules with
the name of the device.