Guardian WebBlogHow the Karma Network Works

How the Karma Network Works

The Karma Network is Guardian Web's shared reputation system: every IP accumulates a behaviour history across all sites on the network and receives an increasingly restrictive response the more damage it tries to cause.

14 Apr 2026 Guardian Web 6 min

One of the most powerful features of Guardian Web is not immediately visible: the Karma Network. It is a shared reputation system that works silently in the background, making the protection of every site on the network smarter with each detected attack.

What is the Karma Network?

Every time an IP performs a suspicious action on any site protected by Guardian Web — a brute-force attempt, a vulnerability scan, a request to sensitive routes — that IP accumulates negative karma points. Karma is a dynamic score that reflects an IP's behaviour history across the entire network, not just a single site.

This means that if an IP attacks one user's site and then tries to access another user's site, it already arrives with its history. It does not start from zero.

How karma accumulates

Each event recorded by the shield carries a different weight in the karma score:

The four response levels

The system's response is proportional to the accumulated karma. There are four levels:

Level 1 — Captcha (low karma)

The IP can still access the site, but must solve a captcha first. This level is ideal for IPs with uncertain but not clearly malicious behaviour. It allows legitimate users with compromised IPs to prove they are human.

Level 2 — Throttle (medium karma)

Access is limited to a maximum number of requests per minute. Brute-force attacks or mass scans become unviable because the time cost multiplies exponentially. The site continues working normally for all other visitors.

Level 3 — Temporary ban (high karma)

The IP is blocked for a configurable period set by the site administrator. Requests from that IP are rejected with an HTTP 403 code. When the period expires, the IP can try again — if it accumulates more negative karma, it is banned again automatically.

Level 4 — Permanent exile (critical karma)

The IP is added to the permanent blacklist of the Karma Network. This list is shared: an exiled IP cannot access any site on the Guardian Web network. It is the most restrictive level and is applied only to IPs with a clearly malicious and sustained activity history.

Why the shared model is key

The fundamental difference between the Karma Network and a local block list is collective intelligence. An attacker who scans a hundred different sites to find vulnerabilities is generating negative karma on each of them. By the time they finally attempt a forceful attack on their identified target, they already arrive banned or with throttle active.

This effect is particularly useful against:

How does this affect my site?

As a Guardian Web site administrator, the Karma Network operates completely transparently. You do not need to configure anything: the system automatically applies responses based on the karma of each IP that reaches your site.

From the Guardian Web dashboard you can see in real time the karma of IPs visiting your site, what response level each one is receiving, and the history of events that generated that karma. You can also add IPs to the whitelist if you need to exclude them from the karma system (for example, your own office IPs).

Conclusion

The Karma Network turns every protected site into a node in a collective intelligence network. The more sites there are on the network, the more information the system has to identify threats before they attack. It is protection that improves on its own over time.

If you have not yet installed Guardian Web on your site, create your free account and start protecting it today.

← Back to blog
Share:

More articles

Your website is already being scanned: the traffic you don't see

Any domain published on the internet receives automated requests every day searching for vulnerabilities. It is not paranoia: it is the statistical reality of today's web, and as the technical barrier to attacking has collapsed, ignoring that traffic is becoming expensive.