What Wardnox does

How a message is judged, what happens when something is caught, and why nothing is enforced until you say so.

Wardnox reads every message in your server, decides whether anything about it is worth acting on, and then does only what you have told it to do. Most messages are read and forgotten in the same instant. Nothing is stored for them, and nothing is sent anywhere.

Evidence, not verdicts

The thing that makes Wardnox different from a word filter is that no single observation decides anything.

A link to a domain nobody in your server has posted before is worth noticing. So is an account created this morning. So is a message that has been written with letters from another alphabet so that it reads normally to a human and not at all to a computer. On their own, each of these is ordinary: people join, people share links, people use accented characters.

Together, they are a different message entirely.

So each detector contributes evidence, and the engine weighs the evidence against the settings you chose. A signal that is weak on its own cannot act on its own, however many times it fires. That is a deliberate property, not a tuning accident: it is what stops a new member being timed out for the crime of being new.

Disguises are undone first

Before anything is judged, the message is read several ways.

Attackers do not write free nitro when they know you are looking for it. They write it with a zero, or with a Cyrillic character that looks identical to a Latin one, or with invisible characters between the letters, or spaced out so the words are no longer words. A filter that reads only what was literally typed catches the careless and nobody else.

Wardnox resolves the message past those disguises and judges what is left. It also keeps what was originally typed, because how hard somebody worked to hide something is itself evidence.

Nothing is enforced until you say so

Every server starts in monitor mode. The engine runs exactly as it would otherwise: it reads, it scores, it decides. It simply does not act. The log tells you what it would have done.

This is the part worth being patient with. Your server has traffic nobody else has, and the only way to know whether a rule fits it is to watch that rule not firing on your own members for a while. When the log stops surprising you, switch to enforce.

Every decision explains itself

When something is caught, the log entry says which rule matched, what it matched, which stage found it, and what was done. If a link claimed to point one place and actually pointed somewhere else, it shows you both.

The reason for this is practical rather than decorative. A moderator who cannot tell whether the bot was right cannot correct it, and a bot nobody can correct gets switched off. Every log entry carries buttons to act on it, including marking a decision as wrong, which is also how the rule that produced it gets measured.

What it will not do

• It will not message a member who was actioned. Somebody who is told exactly what tripped the filter has been handed a map around it.
• It will not act on staff by default. Owners, administrators and moderators are exempt unless you turn that off.
• It will not answer a message it just removed. The conversational side runs behind the security side, so a scam is deleted rather than replied to.
• It will not send anything to a third party until you switch that on. Being on a paid plan does not switch it on either: a plan decides what you are allowed to enable, never what runs.

Where to go next

Once the bot is in your server and has been watching for a day, the log is the best documentation there is. Read a day of decisions before changing anything, then adjust the rules you disagree with rather than the thresholds.