Security settings
Every control on the Security page: what it does, when it is the right one to reach for, and why the numbers are not printed on a public page.
What every control on the Security page does, and when it is the right one to reach for.
The numbers are not printed here, and that is deliberate. This page is public, and the people Wardnox defends against can read it. Publishing the values would tell them exactly how much a message may weigh before it is noticed, which is a tuning guide rather than documentation. Your own values are in your own dashboard, in front of you while you read this.
Enabled, and the mode
Enabled switches Wardnox off for the server entirely. Nothing is scanned. The setting exists so that turning it off is a deliberate, visible act rather than removing the bot and losing your configuration.
Mode is monitor or enforce. Monitor runs everything and acts on nothing. Every server starts there and most should stay there for a few days. See tuning your rules.
Profile
A named set of defaults, from relaxed to locked down. Changing profile moves many settings at once, which is the point: it saves you configuring twenty things to express one intention.
The moment you adjust an individual setting you are on a custom profile. That is expected, not a warning. It only means the profile no longer describes you, so changing profile later will overwrite what you have tuned.
Thresholds
Four values, one per band: low, medium, high and critical. Each says how much evidence a message needs before it lands in that band, and each band has the actions you chose.
Raising a threshold is the blunt instrument, and it is fifth on the list of things to try. It affects every rule and every detector at once, so a single noisy rule can end up making your whole server less sensitive. Fix the rule first.
Lowering one makes the server more suspicious of everything, which is occasionally what you want during an incident, and is what lockdown does for you temporarily.
Detector caps
A ceiling on how much any single detector can contribute. This is the control that stops one signal, however confident, from carrying a message to a destructive action on its own.
Lower a cap when one kind of evidence is dominating your logs but you do not want to lose it entirely. It is a better answer than switching the detector off, because the signal stays available.
Combination bonuses
Some things are unremarkable alone and telling together. This control governs how much extra weight that agreement carries.
Turning it down makes the engine judge each signal more independently. Turning it off entirely makes Wardnox behave much more like an ordinary word filter, which is rarely what anybody wants, because the attacks that matter are usually the ones where nothing individually looks wrong.
Weights
Fine adjustment for individual kinds of signal: links, spam, mentions and so on. Reach for these after fixing the rule and before touching a threshold.
Normalisation
How hard Wardnox works to undo disguises before judging a message: characters from other alphabets that look Latin, invisible characters between letters, text spaced out so the words are no longer words, and encoded payloads.
Two kinds of control here.
Tolerances decide how much of a given trick is normal. A stray accented character is ordinary; a sentence built from three alphabets is not. Raise a tolerance if legitimate multilingual conversation in your server is being read as disguise.
Weights decide how much the disguise itself counts as evidence, separately from whatever was hidden. This matters: somebody who spaced out a word went to deliberate trouble, and that effort is information even before you look at the word.
Which forms are checked is also configurable. Undoing more disguises costs processing on every message, so a server that has never seen an obfuscated attack can reasonably check fewer.
Report obfuscation shows what was undone in the log, which is worth leaving on while you are tuning.
Maximum content length
How much of a very long message is examined. Attacks are rarely long, and the limit exists so a wall of text cannot be used to push the interesting part out of view or to waste processing.
The kill switch
Protection against your own rules, and on by default.
A rule that suddenly starts matching a large share of your traffic is switched to monitor mode automatically, your moderators are told, and the message that tripped it is not acted on. A rule written at midnight cannot empty a channel before morning.
You can set whether it merely pauses the rule or reports without pausing. Leave it on. The cost of it being wrong is one rule needing to be resumed; the cost of it being off is a mass deletion.
Emergency stop and lockdown
Emergency stop halts all enforcement immediately. Scanning and logging continue, so you keep the record of what was happening while you work out what went wrong.
Lockdown is the opposite: it hardens everything at once during an attack. It is reversible and your configuration is snapshotted before it applies.
Find both before you need them.