One of the most powerful features of Guardian Web is not immediately visible: the Karma Network. It is a shared reputation system that works silently in the background, making the protection of every site on the network smarter with each detected attack.
What is the Karma Network?
Every time an IP performs a suspicious action on any site protected by Guardian Web — a brute-force attempt, a vulnerability scan, a request to sensitive routes — that IP accumulates negative karma points. Karma is a dynamic score that reflects an IP's behaviour history across the entire network, not just a single site.
This means that if an IP attacks one user's site and then tries to access another user's site, it already arrives with its history. It does not start from zero.
How karma accumulates
Each event recorded by the shield carries a different weight in the karma score:
- Brute-force attempts — high penalty, especially against wp-login and xmlrpc.
- Sensitive route scanning — access to
.env,admin, non-existent admin panels. - Malicious bot requests — user-agents associated with hacking tools or aggressive scrapers.
- AbuseIPDB reports — if an IP is flagged as malicious in the public database, its karma degrades automatically.
- Normal behaviour — over time, IPs with correct behaviour recover positive karma.
The four response levels
The system's response is proportional to the accumulated karma. There are four levels:
Level 1 — Captcha (low karma)
The IP can still access the site, but must solve a captcha first. This level is ideal for IPs with uncertain but not clearly malicious behaviour. It allows legitimate users with compromised IPs to prove they are human.
Level 2 — Throttle (medium karma)
Access is limited to a maximum number of requests per minute. Brute-force attacks or mass scans become unviable because the time cost multiplies exponentially. The site continues working normally for all other visitors.
Level 3 — Temporary ban (high karma)
The IP is blocked for a configurable period set by the site administrator. Requests from that IP are rejected with an HTTP 403 code. When the period expires, the IP can try again — if it accumulates more negative karma, it is banned again automatically.
Level 4 — Permanent exile (critical karma)
The IP is added to the permanent blacklist of the Karma Network. This list is shared: an exiled IP cannot access any site on the Guardian Web network. It is the most restrictive level and is applied only to IPs with a clearly malicious and sustained activity history.
Why the shared model is key
The fundamental difference between the Karma Network and a local block list is collective intelligence. An attacker who scans a hundred different sites to find vulnerabilities is generating negative karma on each of them. By the time they finally attempt a forceful attack on their identified target, they already arrive banned or with throttle active.
This effect is particularly useful against:
- Coordinated attacks — brute-force campaigns that rotate between multiple targets.
- Prior reconnaissance — scans that look for vulnerable WordPress versions or plugins.
- Botnets — networks of compromised IPs that attack in parallel; each node accumulates its own karma.
How does this affect my site?
As a Guardian Web site administrator, the Karma Network operates completely transparently. You do not need to configure anything: the system automatically applies responses based on the karma of each IP that reaches your site.
From the Guardian Web dashboard you can see in real time the karma of IPs visiting your site, what response level each one is receiving, and the history of events that generated that karma. You can also add IPs to the whitelist if you need to exclude them from the karma system (for example, your own office IPs).
Conclusion
The Karma Network turns every protected site into a node in a collective intelligence network. The more sites there are on the network, the more information the system has to identify threats before they attack. It is protection that improves on its own over time.
If you have not yet installed Guardian Web on your site, create your free account and start protecting it today.