Witen Warden vs CrowdSec
CrowdSec splits the job: an engine decides, and a separate bouncer enforces. Warden is one agent that reads your logs, bans at nftables, tells you why it banned each address, and turns attacks on your WordPress and Matomo sites into firewall bans on the same server.
Published by Witen Labs. Reviewed . Witen Warden 0.1.46; CrowdSec Security Engine v1.8 documentation, with hosted services noted.
Where Witen pulls ahead
One agent, detection to ban
Warden reads your logs and bans at the firewall itself. With CrowdSec, the engine decides and a separately installed bouncer enforces.
See the plan before it touches the firewall
warden discover finds your log sources, warden config plan shows what it would change, and rollback undoes it. Observation mode logs bans without making them.
Your apps feed your firewall
Witen's WordPress and Matomo plugins report login failures and exploit attempts to Warden over a local socket, with no log parsing, and Warden bans the address at nftables.
Side by side
Scroll the table sideways to see both products.
| What matters | Witen | CrowdSec |
|---|---|---|
| From install to first ban Witen's edge | One agent detects and enforces. nftables is the default, in its own table. | Install the engine, then a remediation component for each place you enforce. Architecture. |
| Configuration review Witen's edge | Discover sources, review a proposed plan, apply it, or roll it back from the CLI. | Choose parsers, scenarios, and collections for your services, then configure each bouncer. |
| Application events Witen's edge | Witen's WordPress and Matomo plugins report login outcomes and exploit attempts directly over a local socket. | Parses application logs through scenarios; AppSec inspects requests for compatible integrations. Engine overview. |
| Why an address was banned Witen's edge | warden blocked lists every ban with what the address did and which rule caught it; one command lifts a mistake. | cscli lists decisions and the scenario that triggered each one. |
| Request inspection CrowdSec's edge | Bans addresses at the host firewall. Not a request-inspecting web application firewall. | AppSec rules inspect HTTP requests for compatible integrations. AppSec. |
| Where you can enforce CrowdSec's edge | The host firewall: nftables, iptables, or XDP. | Bouncers for firewalls, web servers, reverse proxies, and more. Remediation components. |
| Free shared blocklist CrowdSec's edge | A small delayed feed on Free; paid plans get the full live feed. | Participating engines receive a community blocklist. Plans. |
| License CrowdSec's edge | Free binary downloads of proprietary software under Witen's terms. | The Security Engine is MIT licensed. |
When CrowdSec is the better pick
You need open-source software, request inspection, or enforcement at a reverse proxy or CDN rather than the host firewall. CrowdSec's modular design is built for that, and its free community blocklist is generous.
Warden fits when the host firewall is your enforcement point and you want one agent you can read, with your own web applications feeding it.
Try Warden next to what you run
Start Warden in observation mode with the null firewall backend and compare its detections with CrowdSec's decisions for a few days. Protect management addresses with never_block, keep a recovery path, then decide which tool owns enforcement.
Warden blocks locally without an account. Enrollment shares security events to power the shared feed; see the privacy policy. CrowdSec documents its own signal sharing and opt-out.
Try it next to what you run today
Start Warden with the null firewall backend to watch what it would ban, add your management addresses to never_block, then switch enforcement on. Local protection is free and needs no account.