iri-dev/WardenOne

<div align="center">

<img src="icons/icon128.png" alt="WardenOne shield" width="112">

WardenOne

<p><strong>One extension. Every defence.</strong></p>

Blocks scams, password theft, dodgy downloads, trackers, fingerprinting, pop-ups and forced redirects. It keeps an eye on your other extensions too. And it all runs on your device.

   Image: Protections Image: No telemetry  

</div>

### No account. No telemetry. No WardenOne tracking. No remote browsing proxy.

No WardenOne backend · Entirely open source · Local-first by design

There's no account and no analytics. Your browsing doesn't go through any server of mine (I don't

have one). Public-list and update checks contact their named sources; optional reputation checks

run only if you turn them on. The privacy policy explains exactly what each sends.

[!WARNING]

Official builds only. WardenOne is a browser extension, never an .exe, installer or setup program. Download it only from github.com/iri-dev/WardenOne. If you received another copy, read the impersonation incident notice.

## One master switch. 108 protections.

105 individually controllable · 3 watch-only

Three of them are watch-only: Background Reports, Hardware & File Access and **Browser

Capabilities**. They write down what happened. They don't block anything so there's nothing

for a switch to turn off.

WardenOne works across the network, pages, downloads, storage and your other extensions. Not just the page you're looking at. And when it blocks something it shows you why.

Site comparisons use a bundled Public Suffix List so separately registered sites under suffixes such as or.jp and k12.ca.us stay separate. Known shared-hosting tenants also keep separate identities; the background worker uses the complete private suffix list.

Page guards run on Google Docs and Drive content and non-login pages on the supported identity-provider domains. Authentication routes keep their compatibility exemptions. On these hosted apps, fingerprint noise, overlay removal and automatic consent handling stay paused while phishing, ClickFix, skimmer, form-trap and fake-update checks remain available.

Custom cosmetic rules are checked individually in the browser, so one invalid selector does not disable the other rules. Unsupported procedural list operators are reported as skipped; native CSS selectors such as :has() remain available.

Inspect it for yourself: Privacy policy · Permissions explained · Security policy · Source · Licence

<p align="center"> <a href="docs/screenshots/01-popup-overview-2026-10.webp"> <img src="docs/screenshots/01-popup-overview-2026-10.webp" alt="Current WardenOne popup with Settings and Arrange buttons, master switch, recommended protections, site summary, protection status and search" width="620"> </a> </p> <p align="center"><em>The main popup. Master switch, current-site summary, protection health and search. Settings and section arrangement are in the top-right. Click any image to see it full size.</em></p>

<details> <summary><strong>Explore the features</strong></summary>

• [Security](#security): scam and phishing warnings, password and session guards, Download Shield, File Shield, and checks on your other extensions.
• [Privacy](#privacy--anti-tracking): tracker and cookie controls, link cleaning, IP-logger protection, and optional anti-fingerprinting.
• [Content blocking](#content-blocking): AdShield for ordinary pages and dedicated handling for YouTube, Twitch, and Spotify, plus search cleanup and Element Zapper.
• [Control and verification](#control-and-verification): pause one site, adjust a protection there, inspect Activity and network requests, write your own rules, and check Protection Health or run the Self-Test.
• [Tools and comfort](#tools-performance-and-comfort): Memory Shield, EyeShield, keyboard and right-click tools, and optional Resource Saver controls to pause GIFs, stop muted video previews, or disable WebGL on selected sites or everywhere except allowed sites.
• [Settings and popup layout](#settings-and-popup-layout): a separate searchable Settings page for switches, site exceptions, notifications, backup, and rearranging the popup's sections.

The popup and Settings captures use the current build. Some other feature screenshots come from earlier builds and may place controls differently.

</details>

Quick install

1. Download WardenOne-latest.zip and unzip it somewhere you intend to keep it.
2. Open chrome://extensions and enable Developer mode in the top-right.
3. Select Load unpacked, then choose the unzipped folder containing manifest.json.

Please leave Developer mode on afterwards. WardenOne isn't on the Web Store, so Chrome counts it as an unpacked extension and switches it off the moment Developer mode goes off. It then stops protecting you, even after a restart, until you turn Developer mode back on.

The About page in Settings shows both the version and the GitHub build ID. Include both when reporting a problem; the version stays the same between rolling builds.

First run

Pick Recommended for the core security baseline. Maximum Privacy adds fingerprint noise, fraud and bot-check script blocking, first-party tracker blocking, breach and clipboard checks, WebRTC hardening, and header/link protections. These can affect calls, screen sharing, graphics, sign-ins or purchases. Choosing Recommended again preserves advanced choices you already enabled; use the individual switches in Settings to undo them.

Then pick Normal notifications or Silent mode. Silent mode still protects you, it just hides the routine pop-ups and badges. Everything's still in the Notification Centre if you want to look.

The on-page badge shows selected page protections, such as blocked pop-ups and overlays. It does not count every network rule; open WardenOne's Site Dashboard in the toolbar for network blocks.

The final setup step links Settings and section arrangement, and has a searchable guide to every protection, popup control and tool. Open a group or search for something like GIFs, WebGL, Zapper or backup to read what it does, see its fresh-install default, and find its controls.

<p align="center"> <a href="docs/screenshots/11-onboarding-feature-guide-2026-10.webp"> <img src="docs/screenshots/11-onboarding-feature-guide-2026-10.webp" alt="Onboarding's full feature guide finds GIF pausing, explains its default and links directly to Settings" width="900"> </a> </p> <p align="center"><em>The full feature guide is searchable, with explanations, default labels and links to the controls.</em></p>

<details> <summary><strong>See the complete first-run journey</strong></summary>

<p align="center"> <a href="docs/screenshots/11-onboarding-welcome-2026-10.webp"><img src="docs/screenshots/11-onboarding-welcome-2026-10.webp" alt="Welcome to WardenOne, with theme choices, no account and no telemetry" width="440"></a> <a href="docs/screenshots/11-onboarding-explore-2026-10.webp"><img src="docs/screenshots/11-onboarding-explore-2026-10.webp" alt="The final onboarding step shows site-card previews, Settings, section arrangement and the full feature guide" width="440"></a> </p>

<p align="center"> <a href="docs/screenshots/11-onboarding-protection-2026-10.webp"><img src="docs/screenshots/11-onboarding-protection-2026-10.webp" alt="The protection step explains the 108 available protections, seven optional providers and the compatibility choices in each preset" width="900"></a> </p>

</details>

<details> <summary><strong>Updating an unpacked installation</strong></summary>

The ZIP gets rebuilt every time I push something that passes the tests. But an unpacked extension does not update itself from GitHub so you have to do it yourself:

1. Export a settings backup from WardenOne before a major update.
2. Download and unzip the newest build.
3. Keep your installed WardenOne folder at the same path and replace its contents with the new build.
4. Open chrome://extensions and press Reload on WardenOne.

Keep the folder in the same place. If the path changes Chromium can treat it as a whole different extension and your settings won't come with it.

The popup checks WardenOne's own GitHub build when you open it. If GitHub confirms that your installed build is an ancestor of the latest complete release, a small update notice appears near the top of the popup. Open Settings → About WardenOne to compare the build IDs, check again, and follow the update steps. The check uses build commits because the extension version stays the same between rolling builds. A source checkout without a packaged build ID, a Store build, a failed check, or a build from a different history is never called outdated. GitHub sees the normal request from your IP address; the commit comparison also sends your public build ID, not your browsing history or the site you are visiting. Results are reused for up to six hours while the browser stays open. WardenOne does not install updates for you.

</details>

Compatibility: Chrome, Brave, Edge, Opera and other Chromium-based browsers. _{Minimum supported Chromium version: 121.}

Why WardenOne exists

Staying safe online usually means installing an ad blocker and an anti-tracker and a fingerprinting tool and a pop-up blocker and a download scanner... and then hoping they all get along. I wanted one extension that just does all of it together. Plus the things content blockers usually skip, like phishing and password theft protection, checking your other extensions, and being able to see whether any of it is working.

A few rules I've stuck to while building it:

• If WardenOne finds nothing it says it found nothing. It won't say "safe".
• If something fails (a rule it can't apply, a missing part, a verdict it isn't sure about) you get to see that. It doesn't get quietly ignored.
• If a protection breaks a site you can back off a little at a time. Pause that site, turn off one protection there, undo one firewall rule. You shouldn't have to turn everything off.

Unknown does not mean safe.

If WardenOne doesn't know, it says it doesn't know.

A file with nothing weird in its structure doesn't get called harmless. An extension that isn't in the local catalogue doesn't get called trusted. Search results never get a green tick just because nothing matched. And if a privacy check can't really be measured it says untestable, not passed.

WardenOne also doesn't promise to be invisible. Some protections have to run inside the page itself and a page that goes looking can spot them (a few named globals, the warnings it draws, the events it uses to talk to itself). Renaming them wouldn't make anyone safer. So instead every single one is written down with the reason it exists, and tools/test-detectability-budget.js fails if a new one sneaks in. A page that finds them doesn't really gain anything either. Anything from the page that leads to a real decision has to be signe