Witen plans

Start free with one site or server.

Connect one Linux server, WordPress site, or Matomo installation on the Free plan. Paid plans add current shared threat data, more connected assets, and support.

Downloads and local protection are included. Matomo’s local protection works without enrollment; connecting to shared intelligence uses a protected-asset slot.

Free

1 protected asset

Free

14-day data delay

1 protected asset
Top-50 blocklist (daily updates)
14-day delay on new threats
IP blocking before WordPress boots
SSH brute-force detection
Login protection + XML-RPC blocking
Fake crawler detection
Malware scanner
Honeypot spam prevention
Bot allowlist management
File integrity monitoring

Create account

Starter

2 protected assets

$12/mo

2 protected assets
Full blocklist (real-time, 5-min sync)
Current shared threat data
Warden binary
nftables / iptables firewalling
SSH brute-force detection
Web server log monitoring
Country blocking
Malware scanner
Honeypot spam prevention

Create account

Growth

5 protected assets

$29/mo

5 protected assets
Use any combination of integrations
Full blocklist (real-time, 5-min sync)
Cross-asset correlation
Warden fleet management
Country blocking
Malware scanner
Honeypot spam prevention
Everything in Starter, plus

Create account

Pro

15 protected assets

$79/mo

15 protected assets
Use any combination of integrations
Full blocklist + correlated IPs
Warden fleet management
ASN blocking
Country blocking
Malware sample submission
TOTP 2FA
Multi-tenant management
Priority support
Everything in Starter, plus

Create account

Enterprise

Custom capacity

Custom protected-asset capacity
Linux, WordPress, and Matomo fleet management
Full network intelligence + correlated IPs
ASN and country controls
JA4 fingerprint intelligence
Multi-tenant management
Custom retention options
Priority onboarding and support

What changes between plans

Capability	Free	Starter	Growth	Pro	Enterprise
Included protected assets	1 protected asset	2 protected assets	5 protected assets	15 protected assets	Custom capacity
Network intelligence updates	Top 50, 14-day delay, daily updates	Full, real-time (5-min sync)	Full, real-time + cross-asset correlation	Full + correlated IPs	Full + correlated intelligence
WordPress integration	Included	Included	Included	Included	Included
Matomo integration	Included	Included	Included	Included	Included
Warden	Included	Included	Included	Included	Included
Compare activity across connected assets	—	—	Included	Included	Included
Manage multiple customer groups	—	—	—	Included	Included
Support	Documentation	Email	Email	Priority email	Priority email

Billing

Monthly and annual checkout are available for self-service plans. Enterprise pricing is scoped with you.

Downloads

Warden DEB, RPM, APK, glibc, and musl builds and the WordPress and Matomo plugins are available after sign-in. Setup guides accompany the downloads.

Questions about plans

What counts as a protected asset?

One directly connected Linux server, WordPress site, or Matomo installation uses one slot. Plugins reporting through Warden’s local socket share its asset slot; directly enrolled plugins count separately. Self-service plans cover up to fifteen assets; Enterprise adds custom capacity, retention, and onboarding.

How is Free different from a paid plan?

Free provides a top-50 shared IP blocklist, updated daily with a 14-day delay on new threats. Paid plans provide current shared data and larger asset allowances. The comparison above lists the features of each hosted plan.

Can I download first and decide on a plan later?

Yes. Create a free account to use the Downloads page, install the software, and review its local controls. Choose a hosted plan when you want to connect your sites or servers.

What happens if I cancel a paid subscription?

You keep paid access through the end of the current billing period. The account then returns to Free limits. Cancellation does not uninstall Warden or the plugins; local rules remain on your systems.