Witen dashboard guide

Add your first site or server

1. Register, verify your email address, and sign in.
2. Choose a plan, or start with the free capacity.
3. Open Add Protection and create your fleet when asked. One fleet credential stands for your account's ownership and limits.
4. Choose Server or VPS, WordPress, or Matomo.
5. Follow that product's guide to create and use a one-time enrollment token. The Matomo plugin supplies its installation ID itself.
6. Setup is done when the asset's first report shows under Protected Assets.

Dashboard map

Read the Operations dashboard

Operations is your landing page. Its 24-hour summary shows accepted evidence, events reported with a local block reason, and unique source addresses. Follow the Activity link for the full graph and rankings.

• Fleet contact counts enrolled installations that reported in the last 24 hours.
• Receipt API available means the collector can serve receipts. It does not mean every actuator has synced its decisions.
• Synchronized enforcement counts real decision receipts, separately from ordinary block reports.
• Fleet health alerts are compromise and attack-surge observations, not a list of every routine block.
• CVE exposure comes from your installed plugin inventory. Confirm it against the affected software before you fix anything.

Investigate Activity

Pick a range from 1 hour to 30 days: 1h, 6h, 24h, 7d, or 30d. Activity shows your account's observations and top sources. New data appears once its five-minute reporting bucket closes.

1. Start at 24h and compare each number with the 24 hours before it.
2. Switch to 1h or 6h to pin down a fresh spike; use 7d or 30d to tell it apart from recurring background traffic.
3. Use Top categories for the behavior, Most active assets for where it hit, and Top sources to separate SSH, web, and plugin views.
4. For examples, go back to Operations and recent events; for deeper host analysis, use Warden's local evidence.

Manage Protected Assets

Protected Assets lists each enrolled installation with its source type, display name, tags, software version, configuration version, last report, and reporting status. Sort by hostname, source, software version, or configuration version to spot drift.

• Reporting: reported within the expected window.
• Delayed: reports are later than expected; check the local service and network.
• Offline: the last report is old enough to need your attention.
• Awaiting first report: enrolled, but no event report has arrived yet.

Verify decisions with receipts

A decision receipt records what the enforcing component, the actuator, did with a decision. Each shows its subject, action, scope, explanation, confidence, evidence count, actuator, lifecycle state, start, and expiry.

• Pending: issued, not yet confirmed as applied.
• Applied: the named actuator reported success.
• Failed: the actuator tried and reported failure; investigate on the host.
• Rolled back: an applied decision was reversed.
• Expired: its blocking period ended.

Manage configurations and policy groups

Share trusted networks safely

The account allowlist takes one exact IPv4 or IPv6 address or CIDR per entry and sends it to your Warden and WordPress protections. Listed addresses are left out of correlation and never blocked.

1. Use the label to say why an entry is trusted.
2. Prefer one exact address to a broad CIDR.
3. Add recovery and administration addresses before you tighten blocking.
4. Behind a proxy, check the client address so you don't allow the proxy by mistake.
5. Remove stale entries regularly.

Downloads and billing

• Before a downgrade, remove or plan for any assets beyond the new capacity.
• Manage payment methods and your subscription in the billing portal.
• Confirm a newly bought slot shows as available before relying on it.
• Contact support for more capacity than the published plans offer.

Troubleshooting and recovery