Short answers to the questions users actually ask. Nothing here leaves your phone — these are all local settings.
Domain filtering runs on Block trackers & spying. With that switch off, Warden never sees a DNS lookup, so neither your custom domains nor the subscribed lists can act. Turn it on from the Firewall tab, or use the button on the warning at the top of the Blocklists screen.
Partly — and it is worth understanding why. Warden sees the hostname a connection is going to, never the page address. The path (/r/something) is inside the encrypted request, and the only way to read it is to break the encryption on every connection you make. Warden will never do that; it is the exact thing the app exists to prevent.
What you can do is block the separate hostnames a site uses for different jobs. Reddit serves images from i.redd.it, video from v.redd.it and previews from preview.redd.it. Block those three and text Reddit still works while the media does not — which is usually the point.
How to find them: open Activity → DNS, use the site for a minute, and every hostname it contacts appears in the list. Tap any one to block it. If you go too far, tap it back.
Blocking a single subreddit, channel or page is not possible for any firewall — that needs a browser content blocker.
If Android’s Block connections without VPN is on, it drops anything that is not going through the VPN — and excluding an app takes it out of the VPN. The two settings contradict each other, so an excluded app ends up with no connection at all. Either leave the app running through Warden, or turn that Android setting off.
Usually IPv6 and HTTP/3. Update to the latest version — builds before 1.7.7 could silently discard modern HTTP/3 traffic on IPv6 networks instead of telling the app to use a route that works.
App lock asks for a credential before protection can be turned off — from the app, the quick-settings tile or the notification. You can use your fingerprint and phone PIN, or set a Warden-only password that is independent of the phone: letters, numbers and symbols. Choose that one if somebody else knows your phone’s code or has a fingerprint enrolled on it. There is deliberately no way to recover it.
It is tamper resistance, not tamper proofing. Android always lets someone remove a VPN or an app from Settings, and no in-app lock can stop that.
Deep Inspection and combined mode route every packet through Warden’s own forwarder so it can show you each connection. That costs throughput on very large transfers. If a multi-gigabyte download matters more than logging it, switch Deep Inspection off for the duration.