Password guessing
Repeated failed logins get the address locked out. Add two-factor sign-in with an authenticator app, with recovery codes for the day you lose your phone.
Security for WordPress and Linux
Caught in WordPress. Banned at the firewall.
Witen spots attackers inside WordPress and hands the ban to your server's firewall, so their next request never loads a page. On shared hosting, it blocks inside WordPress instead.
Free to install. No account needed.
How it works
Spot it in WordPress.
The plugin sees failed logins, scanners, and abusive crawlers where they happen, with no account needed.
Ban it at the firewall.
If Warden runs on the same server, the plugin hands the ban over and the attacker is dropped by nftables before WordPress loads. Warden runs without root.
Recognize it next time.
With an account, addresses that attacked other Witen sites are blocked before they reach yours.
On shared hosting, the plugin still covers steps one and three. On your own server, add Warden for all three.
What Witen throws out
Bots and AI crawlers
Decide crawler by crawler who reads your site: welcome the search engines and AI assistants you want, block the ones you don’t, and shut out the tools attackers use to scan.
Exploit probes
Requests for known WordPress exploits are refused on the spot, and scanners hunting for webshells and admin panels get banned after a few tries.
Pick where it runs
Use one, or combine them: a WordPress site on a server you run gets the plugin's insight and Warden's firewall.
Witen Blocker
WordPress
A plugin that protects your login, controls bots, and checks your files from the WordPress dashboard.
Works on shared hosting.
Explore WordPressWiten Warden
Linux servers
An agent that reads your SSH and web server logs and blocks attackers at the firewall, before they reach PHP.
Needs administrator access to the server.
Explore Linux serversWiten for Matomo
Matomo
Login limits, IP rules, and bot policies for your self-hosted Matomo analytics.
Protects Matomo itself, not the sites it tracks.
Explore MatomoNo black boxes.
See which address was blocked, what it did, and which rule caught it. Allow an address you trust or lift a block in one step. Blocks expire on their own, and your protection keeps running even if witenlabs.com is down.
Read the Warden setup guide
Screens show a demonstration host with synthetic attack traffic from documentation address ranges.
Learn from every attack, not just yours
Connect a free Witen account and your sites receive blocklists built from attacks seen across every Witen site and server. An address caught attacking another Witen site can be turned away from yours before it tries.
Free WordPress sites receive the WordPress threat feed, updated daily, with no added data delay or top-50 cap. The standard Free feed includes up to 50 IPs, updated daily with a 14-day delay on new threats. Compare plans.
Your rules stay local
Login limits, IP rules, and bot policies run on your server or inside the plugin. Nothing waits on a cloud round trip.
Shared blocklists are optional
Connecting an account adds blocklists and reports. Disconnect and local protection carries on.
See the whole campaign
On plans with correlation, follow one attacker across every site you run.
witen, v. Old English: to know; to be aware.
Built from years of watching this traffic
Witen comes from years spent running security for web hosting companies and content delivery networks. The same password guessing, scanners, and scrapers hit every site on those networks, and the smallest sites had the least between them and it. Witen is the protection they should have had: it runs where your site runs, explains every decision, and learns from every site it protects.
Compare security tools
All comparisonsCommon questions
Which Witen product do I need?
Use the WordPress plugin for a WordPress site, including on shared hosting. Use Warden for a Linux server you administer. Use the Matomo plugin for self-hosted Matomo. If your WordPress site runs on your own server, use both.
What is free?
All local protection. Install Witen Blocker from WordPress.org or Warden from the Linux downloads; the Matomo plugin needs a free account to download. A free account also connects 1 site or server to shared blocklists. Free WordPress sites receive the WordPress threat feed, updated daily, with no added data delay or top-50 cap. The standard Free feed includes up to 50 IPs, updated daily with a 14-day delay on new threats. Paid plans add more sites and the full global feed.
Do I have to move my website or change DNS?
No. Warden runs on your Linux server, and the plugins run inside WordPress or Matomo. Your traffic never goes through a Witen proxy.
Will it lock me out?
Add your own address to the trusted list first, and keep your two-factor recovery codes somewhere safe. If you do get locked out, Recover login access shows how to get back in.
Give the bots a worse day
Install takes a few minutes. Protection starts the moment you activate.
Questions before you install? Email support@witenlabs.com.