Skip to content
monolab— home
monolab

Pages

Elsewhere

Press I to open this index, Esc to close it.

Warden · system-wide blocker for windows · betaNothing gets through all seven.

Every blocker has a gap somewhere. Warden puts seven layers on your Windows PC, and each one is solid where the layer above it leaks. One install covers every browser and every app.

Download WardenSee the seven layers

Illustration: seven layers in the outline of Warden's shield, stacked over a brass line labelled Your screen. Seven thin beams of light fall from above. Each is a way around a blocker, and each is caught by a different layer. No light reaches the line.

  • Every browser, every appFiltered at the PC’s own resolver
  • No accountNothing to sign up for
  • Nothing sent homeNo telemetry and no cloud dashboard
  • Free, foreverPro is $35 a year or $99 once
01

How it holds

Each layer exists because the one above it leaks. They are numbered because the order is the argument.

Nobody has to set seven layers by hand. The first time Warden opens it asks what you want help with — quitting porn, gambling, protecting a child, focusing on work — and switches on everything that takes, in about a minute.

  1. Layer 01The starting point

    Every lookup on the machine goes through Warden

    Warden runs a DNS resolver on the machine and points Windows at it. Browsers, apps and background updaters are all filtered by the same rules, and none of them need anything installed. It takes over system DNS only when you say so, keeps a snapshot of what was there before, and puts it back on request.

    • Fourteen categories. Ads, trackers, malware and scams, adult, gambling, social media, games, dating, shopping, food delivery, video and streaming, piracy, drugs, and smart-TV telemetry — millions of domains, re-checked for new versions every few hours rather than once at install.

    • Encrypted upstreams. DNS-over-HTTPS, DNS-over-TLS or plain, from a catalog of public resolvers — including ones that filter adult content themselves — or an address of your own.

    • Your own rules. Block or allow specific domains, with patterns. An allow always wins. A rule that cannot work is shown to you, with the reason, instead of being quietly dropped.

    • Your own lists. Add any blocklist by URL or file, in hosts, domains or adblock format.

    • A pause that ends by itself. Suspend filtering for a set period. It is a deadline rather than a switch, because a pause somebody has to remember to end is an unprotected machine nobody notices.

  2. Layer 02The browser brings its own resolver

    Browser policy, and something to hold it in place

    Chrome, Edge, Firefox and their relatives can run their own DNS over HTTPS. When they do, the machine's resolver never sees the lookup and every list on it becomes decoration. Warden turns that off by enterprise policy — and re-asserts the policy, because a policy written once is a policy something else can delete.

    • Browser DNS-over-HTTPS switched off. Per browser, by policy, and checked again rather than written once.

    • Private browsing removed. A private window was always filtered identically; what it defeated was the record, and for anyone using Warden against their own habit the record is half the point.

    • Proxy settings pinned. So a browser cannot send the connection and the name resolution somewhere Warden never sees.

    • Proxy-permission extensions blocked. The one permission every VPN and proxy extension needs.

    • Extensions you choose, force-installed. And not removable, in Chromium browsers and Firefox alike.

    • Reversible by design. The existing policy is snapshotted before anything is written, and restored when you turn the lockdown off.

  3. Layer 03Install a browser that ignores policy

    A browser Warden cannot police does not open

    Every policy above reaches a browser through a registry key that the common browsers read. Installing one that does not read it takes a single download and no administrator rights, and on that machine the whole layer above is decoration. So the browsers Warden cannot filter are stopped from running.

    • A catalog of browsers that ignore policy. Tor Browser among them.

    • Identified by the file's own version information. So renaming the executable, or shipping a fork of it, does not walk past the check.

    • Running processes are swept. So one that was already open when the lock came on is caught too.

    • Exceptions by name. For somebody who needs a particular browser for work and accepts that Warden cannot filter it.

    • The block explains itself. Whoever launched it gets a panel naming the program and saying why it did not open, rather than a double-click that silently does nothing.

  4. Layer 04Send DNS straight to a hardcoded address

    Who may ask, not only what the answer is

    A program can skip name resolution altogether and send DNS straight to an address it has built in. No hostname is involved anywhere in that, so no blocklist can reach it. This is the layer that closes it, and it is the one that needs the firewall rather than the resolver.

    • Plain DNS to anywhere but Warden, blocked. At the Windows firewall.

    • DNS-over-TLS and DNS-over-QUIC blocked with it. On port 853.

    • Known public DNS-over-HTTPS resolvers blocked by address. On 443 — the only thing that stops a browser pointed at a bare IP.

    • Allowances where a machine needs them. A corporate resolver, a domain controller, or private ranges when virtual machines resolve through a virtual adapter.

    • The Windows hosts file is baselined and watched. Entries added since are reported. Reverting them is a separate choice, because pointing a name at a development server is also what that file is for.

  5. Layer 05The ad inside a page you asked for

    The page closes up, instead of leaving a hole

    Blocking an advertisement's domain stops it loading and does nothing about the space it was going to occupy. On a news site that is a black band a few hundred pixels tall, and from the reader's side that is not the ad being blocked, it is the page being broken. Closing that gap means changing the page, inside the browser, where the page is already decrypted.

    • Warden's own extension, on managed PCs. On a PC joined to a work domain, Warden installs its own extension by policy, carrying element-hiding rules compiled from the same lists, so the layout closes up instead of leaving the gap. Chrome and Edge do not allow this on a home PC; there, ads are still blocked at the resolver, and the space they leave can stay.

    • Extended CSS and site-specific rules. For the pages an ordinary selector cannot describe.

    • Scriptlets. For the advertisements a page builds with its own code rather than fetching.

    • Nothing in the network path. No proxy, no certificate authority, nothing that can take a machine off the internet.

  6. Layer 06It was never a browser

    Programs, folders and files — not only sites

    Some of what people want kept off a machine was never a website. A game, a chat client, a folder of downloads. Warden blocks those the way Windows itself understands them, and every block it applied can be lifted in one command.

    • Stop a program launching, or reaching the network, or both. Block means the program does not start.

    • Pick from what is installed, or from what is running now. Or type a name. Three ways to name a program, because a full path, a bare executable name and a publisher are each right in different cases.

    • Recovery tools take a separate confirmation. Blocking Command Prompt, PowerShell, Registry Editor or Task Manager is accepting that you may be removing the tools you would undo this with.

    • Deny a folder, or a single file. To standard users, or to everyone including administrators.

  7. Layer 07Open the settings and switch it off

    Settings that spend time, not permissions

    Everything above is undone by opening the settings, which is why the settings are a layer of their own. Most protections here are friction an administrator can eventually take back. One is not: a delay cannot be granted around.

    • A password on the settings. Stored only as a hash, so the settings file never contains it.

    • An accountability partner. Somebody you trust scans a QR code once with any authenticator app. From then on, turning protection down needs the six-digit code their phone shows, so you have to ask them. Nothing is sent to them or to us; removing them needs no code, and takes a week.

    • A delay on anything that weakens protection. Turning a category off, adding an allow, giving up the DNS takeover. Tightening protection is never delayed. This is the measure that spends time rather than permissions, and the one an administrator cannot simply step around.

    • Pause limits. A pause is the easy way round everything else — five minutes, then five more. Cap how many a day and how long each runs. The count is kept by the service, not the settings file, and turning the clock back gives none back.

    • A hard moment. One button, in the window or the tray, for when an urge hits. For an hour, four hours or a day, adult, dating and gambling sites are blocked on top of everything else, allows and pauses stop counting, and nothing ends it early — not the password, not the partner. Anything that loosens protection waits until it is over.

    • The service can be locked. Against being stopped or deleted from the Services window or the command line.

    • The uninstaller asks for the same key. The password, or the partner's code.

    • Nothing happens quietly. Warden names what a pending change would loosen, and how long it will wait before taking effect.

  8. All sevenOne shield

    Nothing lines up, so nothing gets through.

    Each layer is solid where the one above it leaks. Every lock is reversible, and Warden snapshots what it replaces before it touches anything.

    Download WardenSee pricing
02

In motion

Play1:47

107 seconds. Nothing loads until you press play.

On YouTube
03

Time, and what a search returns

Four controls that are not about blocking a destination at all.

01

Safe search, forced

Filtered results on the major search engines, applied at the resolver so it holds in every browser. YouTube's restricted mode is its own separate setting, at moderate or strict, because plenty of people want one without the other.

02

Blocking plans, all running at once

Work, study, bedtime, the weekend — each a plan of its own, with its own categories, websites and apps and its own hours. Every plan that is on runs at the same time, and each only adds blocking. Start from a ready-made plan or build one; taking a plan down waits out the delay like anything else that loosens protection. Plans can be switched from a script or Task Scheduler too.

03

Daily time limits, per app and per website

An allowance for a game, Discord or youtube.com: one amount on school days, another at the weekend. Time counts only while it is in front of somebody, full-screen video included. Five minutes before the end a notice says so; at the end the app closes, or the site's tab closes and the site is blocked in every browser, until midnight. Turning the clock back does not buy more time.

04

A focus timer, with sounds to work to

Pick a rhythm and press Start. During each block of work, social media, video, games and shopping are blocked in every browser; on the break they come back. Anything you block all the time stays blocked, breaks or not. Rain or soft noise plays alongside, offline, to cover the room.

04

What it shows you

A blocker that cannot tell you whether it is working is asking to be trusted on its word.

Warden's dashboard. A banner reads Protected: filtering 8 blocklist groups, with a button to run a full check. Below it a row asks Having a hard moment?, with a Hard moment button, then four counters: 6,204 blocked in 24 hours, 41,882 queries, 218 thousand blocked all time, and 3,912 allowed by exception. A chart of queries and blocks per hour begins underneath. The sidebar lists Dashboard, Enforcement, Activity, Usage, Websites, Apps, Files, Browsers, Network, Focus timer, Focus sounds, Protection, Settings and Recovery.
Warden 1.0.0 — the dashboard, with example data
  • 01

    Enforcement, measured

    Every protection is checked against the machine, not read back out of the settings file — so on means it is actually happening. Anything switched on and doing nothing is listed with the reason and the fix.

  • 02

    A block that explains itself

    When a site is blocked, a small panel says which one and why. Limited to the categories worth interrupting somebody for, and never for the dozens of ad lookups a single page makes.

  • 03

    Activity, and time

    What was asked for, and — separately, and only if you turn it on — how long each application and website was actually in front of you, with idle time excluded, by day, week, month or year, and kept for a year. The two are collected differently and are labelled as what they are.

From the command line

One command reports everything in force. It runs in an administrator terminal in Warden's folder, or from Task Scheduler.

Windows PowerShellExample output
PS C:\Program Files\Warden> .\warden-svc.exe -status
Warden, Sat 7 Nov 21:40

Service       running
Filtering     on
Licence       Pro
Protection    partner Sam · delay 24h0m0s · uninstall protection on
Focus         no focus session
Categories    ads, trackers, malware & scams, adult content, gambling, dating
Plans         Work (blocking), Bedtime
Pauses        2 left today

PS C:\Program Files\Warden> .\warden-svc.exe -plan-on Study
The plan "Study" is on.

  • Scripts and Task Scheduler. Plans, the focus timer, a hard moment, websites and categories all have a command, and the status prints as JSON too.

  • Adding protection asks for nothing. Your Work plan can switch on at nine every weekday, with no password stored anywhere.

  • Taking it away asks, then waits. It needs the password or your partner’s code and waits out your delay, so a script is never a way around them.

05

What it does not claim

Every line above is something Warden holds. These four are the edges — where it stops, and what it will not pretend to do.

  • It is not administrator-proof

    Most of what is here is friction: an administrator with enough determination can take the permissions back. The documentation says which parts, and where the escape hatches are, rather than letting somebody find out at the worst moment.

  • It does not read your traffic by default

    There is no HTTPS content filter in this version, and nothing that decrypts traffic is compiled in.

  • It sends nothing home

    No telemetry, no accounts, no dashboards elsewhere. Blocklists are downloaded from their publishers into a cache on the machine; your queries go to the upstream resolver you picked; the query log and the usage record stay on the machine and can be turned off.

  • It cannot filter what it cannot see

    A browser that ignores policy, or traffic over a VPN the machine dials out itself, is outside what a resolver can reach. That is the reason layers 03 and 04 exist — and where a gap remains, the screen says so instead of showing a green tick.

06

Pricing

The free version blocks, and keeps its lists current, for as long as you run it. Pro is for the moment you would switch it off: by the year, or once for good.

Free

forever

$0

Download Warden

Windows 10 and 11. No account, and nothing sent anywhere.

Included

  • Blocks websites in every browser and every app on the PC, not just one browser
  • Category blocklists, plus your own custom rules
  • Safe Search forced on in search engines
  • Removes ads and trackers from pages
  • Stops browsers getting around the blocking (secure DNS and built-in DNS bypasses)
  • Statistics on what was blocked
  • Blocklists keep updating for free, forever
  • A hard moment button: everything risky locked down for an hour or a day
  • A focus timer: the classic 25/5 rhythm, distractions blocked while you work
  • Three focus sounds: rain, brown noise and pink noise
  • One blocking plan: categories and websites on the hours you choose

Pro Yearly

Most popular

$35/year

Buy Pro Yearly — $35/year

Included

  • Every Pro feature
  • Every new version while subscribed
  • Renews automatically, cancel any time
  • 7-day free trial in the app first

Prices in USD, local tax included. Sold by Monolab; payments by Polar, our merchant of record. Use on up to 5 PCs in your home. 7-day refund on any payment.

Free vs Pro

Free blocks. Pro makes it stick.

FeatureFreePro
Websites
Blocklists: ads, adult, gambling, social and moreIncludedIncluded
Blocklists update automatically, foreverIncludedIncluded
Your own block and allow rules, and letting a site through for a whileIncludedIncluded
Safe Search and YouTube restricted modeIncludedIncluded
Extra blocklists by web address or fileNot includedIncluded
A blocking plan: categories and websites on their own hoursIncludedIncluded
Unlimited plans running at once, with appsNot includedIncluded
Browsers
Stops browsers getting around the blockingIncludedIncluded
Ads removed from pages, cookie banners hidden and YouTube ads skippedIncludedIncluded
Websites cannot send notification spamIncludedIncluded
Privacy protection: fingerprint noise, tracking tags taken off links, and WebRTC kept from giving away your addressNot includedIncluded
Scams
Malware and phishing sites blockedIncludedIncluded
DNS rebinding blocked, so a website cannot reach your router or home devicesIncludedIncluded
Look-alike sites blocked, and fake sign-in pages and brand-new sites flaggedNot includedIncluded
Fake virus warnings stopped, and pasted-command scams taken off the clipboardNot includedIncluded
Remote-access tools blocked: the ones a caller on the phone asks you to installNot includedIncluded
Apps
Statistics on what was blockedIncludedIncluded
Block apps, folders and filesNot includedIncluded
Usage tracking: time on each app and website, by day, week, month or yearNot includedIncluded
Daily time limits for apps and websitesNot includedIncluded
Focus
Focus timer: distracting sites blocked for each block of work, back for the breakIncludedIncluded
Long and Deep rhythms (50 and 90 minutes), and choosing what is blockedNot includedIncluded
Focus sounds: rain, brown noise and pink noiseIncludedIncluded
Eight more sounds, three at once, and a fade-out timerNot includedIncluded
Protection
Hard moment: one button locks everything risky down for an hour or a dayIncludedIncluded
Password on settings and uninstallNot includedIncluded
Accountability partner: a trusted person's phone holds the keyNot includedIncluded
Uninstall protectionNot includedIncluded
Cool-down delay before protection can be weakenedNot includedIncluded
Pause limits: how many pauses a day, and how long each runsNot includedIncluded
Automation
Command line: plans, focus timer, hard moment, websites and categories from scripts and Task SchedulerIncludedIncluded
Side by side · 9 Windows blockersHow Warden comparesWarden side by side with AdGuard, Cold Turkey, FocusMe, Freedom, Covenant Eyes, Canopy, Qustodio and Net Nanny on Windows.See all 35 rows

Questions about paying

Is this a subscription?
Pro Yearly is: $35 a year, renewing by itself until you cancel. Pro Lifetime is not: $99, once.
What happens after the first year?
With Pro Yearly, Warden renews itself and nothing needs entering. If you cancel, Pro stays on until the end of the year you paid for, plus a 21-day grace period; then Warden goes back to the free edition, blocking keeps working, and your settings are kept. Pro Lifetime never runs out.
How do I cancel Pro Yearly?
Any time, from the link in your receipt email or at monolab.dev/warden/manage.
Do I need an account?
No. You get an activation code by email and paste it into the app.
Lost your code?
Every code can be emailed again, to the address it was bought with. Have it sent again.
How many PCs?
Up to 5 in your home. Warden activates your code on each PC the first time it's online. Moved to a new PC? Remove the licence from the old one, or its place frees up by itself after 90 days unused.
Can I try it first?
Yes, 7 days of everything, inside the app.
Refunds?
Within 7 days of any payment, renewals included, no questions asked. Email support@monolab.dev.
Can someone with admin rights still remove it?
Yes. Pro makes it much harder and slower, but a determined administrator on the PC can always remove software, and Warden does not pretend otherwise.
What is an accountability partner?
Someone you trust, such as a spouse, a friend or a sponsor. They scan a QR code once with an authenticator app on their phone, such as Google Authenticator or Microsoft Authenticator. After that, turning protection down, pausing, updating or uninstalling Warden needs the code their phone shows, so you have to ask them first. They never see what you browse, and nothing is sent to them or to us. If they can't be reached, you can remove them without a code; it takes a week. Part of Pro.
Can I limit time instead of blocking?
Yes. Give any app or website a daily allowance, with a different amount at the weekend. Five minutes before it runs out you get a warning; then the app closes, or the website is blocked in every browser, until midnight. Raising a limit needs the password or your partner's code. Part of Pro.
Can I see how much time I spend on each app and website?
Yes, with Warden Pro. The Usage screen shows how long each app and each website was in use — today, this week, this month or this year, and any day, week, month or year before it — with a chart, the apps and sites that took the time, how often each was opened, and how it compares with the period before. Website time is time a site was in front of you in your browser, with nothing installed in the browser. It is off until you switch it on, it is kept for a year by default, and it never leaves your PC.
Can Warden limit screen time for the whole computer, or set a bedtime?
Not by itself, and on purpose: Windows already does it well. Warden limits the apps and websites you choose. For a limit on the computer itself — two hours a day, or nothing after nine — use Microsoft Family Safety, which is free and built into Windows: give your child a Microsoft account, add them to your family, and set their screen time there. Leave Family Safety's web filter off. It only works in Microsoft Edge and stops every other browser, while Warden filters every browser on the computer and cannot be switched off without your password.
My child needs one blocked website for homework. Do I have to unblock it?
No. Allow it for a while instead: type the website on the Websites screen and choose 30 minutes, an hour, two hours or until midnight. Everything else stays blocked, and when the time is up the website is blocked again by itself. If a settings password is set, it asks for it first.
Can I have different rules for work, study and the weekend?
Yes — make a blocking plan for each. A plan is what to block (categories, websites and apps) and when: always, during set hours, or at every time except them. Every plan that is on runs at once, and each only adds blocking, so a site in your Work plan and your Bedtime plan is blocked for both. The free edition runs one plan at a time; Warden Pro runs as many as you like, and adds apps to plans.
What is the hard moment button?
For when an urge hits. Press it in the window or the tray and choose an hour, four hours or until this time tomorrow. Adult, dating and gambling sites are blocked on top of everything else, sites you allowed and any pause stop counting, and nothing ends it early — not your password, not your partner. Anything that loosens protection waits until it is over, and Warden cannot be uninstalled until then. A calm screen with a breathing guide stays with you while it passes. Free, in every edition.
Can I stop myself pausing Warden all day?
Yes, with pause limits in Warden Pro. Choose how many pauses a day — as few as one — and how long each may run, from five minutes to two hours. Once they're used, the pause buttons are gone until midnight. Turning the clock back doesn't bring them back, and loosening the limits waits out your delay and needs your password or your partner's code, so it can't be undone in a weak moment.
Does Warden have a Pomodoro timer?
Yes — the focus timer. Pick a rhythm, choose how many blocks, and press Start. While you work, distracting sites are blocked in every browser; on the break they come back, and every fourth break is a longer one. Anything you block all the time stays blocked, breaks or not. The classic 25/5 rhythm on social media, video, games and shopping is free. Pro adds 50- and 90-minute rhythms and lets you choose what is blocked.
What are focus sounds?
Ambient sounds to cover the noise around you while you work: rain, brown noise and pink noise are free; Pro adds ocean, wind, a fireplace, a night outdoors, a café, a library, a calm tone and white noise, plays up to three at once, and can fade them out after a set time. They ship inside Warden and play offline. Nothing is streamed.
Who processes the payment?
Polar, the reseller. They handle the payment, tax, receipts and refunds.
Does it work with a work VPN?
Usually. VPNs that tell Windows where to send their own internal names keep working. With others, company-only sites (and router pages such as fritz.box) may not open while Warden filters; open the router by its address, or switch Warden's filtering off while connected. Better support for this is planned for an update.
Can I control Warden from scripts or Task Scheduler?
Yes. Plans, the focus timer, a hard moment, pausing, your own blocked and allowed websites, categories and apps all have a command, and one command reports everything in force — as JSON too, for a script. Anything that adds protection asks for nothing, so Task Scheduler can switch your Work plan on at nine every weekday with no password stored anywhere. Anything that takes protection away asks for your password or your partner's code and waits out your delay, so a script is never a way around them. Settings › Advanced lists every command with a copy button and opens a terminal in the right place. Free, in every edition.
07

The beta

The beta is now open to everyone. Warden works and it is on other people's machines, but it is not finished. What that buys you is a say in what it becomes. What it costs you is the rough edges below, stated here rather than discovered.

Download Warden

What is still rough

  • 01Windows 10 and 11 only. There is no macOS or Linux build and no date for one.
  • 02The layers that use browser policy and the firewall need administrator rights. Warden names which ones before it asks, and applies nothing it did not name.
  • 03Every lock is reversible, including mid-beta: the DNS and policy settings Warden replaced are snapshotted first and put back when a layer is turned off.
Platform
Windows 10 & 11
Runs as
Windows service
Licence model
yearly or lifetime, offline
Account
none

Blocklists

blocklistproject · UT1 Toulouse (CC BY-SA 4.0) · HaGeZi

Next

BlockNSFW

porn & adult content blocker