Security settings

Every control on the Security page: what it does, when it is the right one to reach for, and why the numbers are not printed on a public page.

What every control on the Security page does, and when it is the right one to reach for.

The numbers are not printed here, and that is deliberate. This page is public, and the people Wardnox defends against can read it. Publishing the values would tell them exactly how much a message may weigh before it is noticed, which is a tuning guide rather than documentation. Your own values are in your own dashboard, in front of you while you read this.

Enabled, and the mode

Enabled switches Wardnox off for the server entirely. Nothing is scanned. The setting exists so that turning it off is a deliberate, visible act rather than removing the bot and losing your configuration.

Mode is monitor or enforce. Monitor runs everything and acts on nothing. Every server starts there and most should stay there for a few days. See tuning your rules.

Profile

A named set of defaults, from relaxed to locked down. Changing profile moves many settings at once, which is the point: it saves you configuring twenty things to express one intention.

The moment you adjust an individual setting you are on a custom profile. That is expected, not a warning. It only means the profile no longer describes you, so changing profile later will overwrite what you have tuned.

Thresholds

Four values, one per band: low, medium, high and critical. Each says how much evidence a message needs before it lands in that band, and each band has the actions you chose.

Raising a threshold is the blunt instrument, and it is fifth on the list of things to try. It affects every rule and every detector at once, so a single noisy rule can end up making your whole server less sensitive. Fix the rule first.

Lowering one makes the server more suspicious of everything, which is occasionally what you want during an incident, and is what lockdown does for you temporarily.

Detector caps

A ceiling on how much any single detector can contribute. This is the control that stops one signal, however confident, from carrying a message to a destructive action on its own.

Lower a cap when one kind of evidence is dominating your logs but you do not want to lose it entirely. It is a better answer than switching the detector off, because the signal stays available.

Combination bonuses

Some things are unremarkable alone and telling together. These are a list rather than a dial: each combination is its own entry, with its own extra weight and its own switch, and a set of them ships configured.

Turning an entry down makes the engine judge that particular pairing more independently. Switching them all off makes Wardnox behave much more like an ordinary word filter, which is rarely what anybody wants, because the attacks that matter are usually the ones where nothing individually looks wrong.

Weights

Fine adjustment for individual kinds of signal: links, spam, mentions and so on. Reach for these after fixing the rule and before touching a threshold.

Normalisation

How hard Wardnox works to undo disguises before judging a message: characters from other alphabets that look Latin, invisible characters between letters, text spaced out so the words are no longer words, punctuation used to break a word apart, digits and symbols standing in for the letters they resemble, and encoded payloads.

Two kinds of control here.

Tolerances decide how much of a given trick is normal. A stray accented character is ordinary; a sentence built from three alphabets is not. Raise a tolerance if legitimate multilingual conversation in your server is being read as disguise.

Weights decide how much the disguise itself counts as evidence, separately from whatever was hidden. This matters: somebody who spaced out a word went to deliberate trouble, and that effort is information even before you look at the word.

Which forms are checked is also configurable. Undoing more disguises costs processing on every message, so a server that has never seen an obfuscated attack can reasonably check fewer.

Report obfuscation shows what was undone in the log, which is worth leaving on while you are tuning.

Maximum content length

How much of a very long message is examined. Attacks are rarely long, and the limit exists so a wall of text cannot be used to push the interesting part out of view or to waste processing.

The kill switch

Protection against your own rules, and on by default.

A rule that suddenly starts matching a large share of your traffic is switched to monitor mode automatically, your moderators are told, and the message that tripped it is not acted on. A rule written at midnight cannot empty a channel before morning.

You can set which of two things it does: switch the rule off entirely, or leave it running as evidence while stopping it from enforcing. Either way the message that tripped it is not acted on. Leave it on. The cost of it being wrong is one rule needing to be resumed; the cost of it being off is a mass deletion.

The escalation ladder

Repeat offences get a firmer response than first ones. The ladder is how you say what "firmer" means.

Each rung is a number of offences and the action to take once somebody reaches it. A first offence is deliberately not on the ladder: it is judged on its own, and the ladder exists to escalate repeats. Adding a rung for the first offence is allowed and does nothing.

What ships is a single rung rather than a graduated ladder, because the shipped action ends it. Once somebody is banned, every rung above that is unreachable, and leaving unreachable rungs in a default invites you to tune one nobody will ever stand on. If you want a graduated response, add milder rungs below it.

Three settings shape what counts:

How long an offence counts for. Violations older than this stop contributing. This is its own window and has nothing to do with how long records are kept.

How serious an offence has to be. Below this severity, it does not count towards the ladder at all, so a minor rule firing repeatedly does not walk somebody up it.

It only ever adds. Escalation never removes an action the risk band already chose. A repeat offender cannot end up treated more gently than a first-time one because of how the rungs were written.

Marking something a false positive removes it from this history, so tuning your rules does not push somebody up the ladder for your mistake.

Deletion tracking

Off until you turn it on, and available on every plan.

It records messages removed from your server and, where Discord will tell it, who removed them. That is what makes a scammer clearing up after themselves visible: the posts are gone from the channel, and the record of them is not.

Discord does not always say who deleted something. Rather than guess, the record distinguishes a message the author deleted from one it could not attribute at all, because those are different facts and treating them as the same one is how a log stops being evidence. Granting Wardnox View Audit Log is what lets it name somebody other than the author.

Two things worth setting deliberately. It keeps the text of deleted messages by default, which is the useful part and also the part with privacy weight, so it respects your message-storage setting and can be turned off on its own. And it ignores Wardnox's own enforcement by default, because an action it took already produced a log entry, and recording it twice makes this log mostly a copy of that one.

Records are kept for a month unless you change it.

Emergency stop and lockdown

Emergency stop halts all enforcement immediately. Scanning and logging continue, so you keep the record of what was happening while you work out what went wrong.

Lockdown is the opposite: it hardens everything at once during an attack. It is reversible and your configuration is snapshotted before it applies.

Find both before you need them.