> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coral.inc/llms.txt
> Use this file to discover all available pages before exploring further.

# Harden Your Self-Hosted Instance

> Step-by-step guide to securing a self-hosted OpenClaw instance against the most common attack vectors

This guide covers the steps needed to secure a self-hosted OpenClaw instance. The hardening steps are the same regardless of which cloud provider you use — the differences between providers are limited to firewall configuration syntax, which is noted where relevant.

The steps are ordered by impact. Work through them in sequence.

<Note>
  If you'd rather shut down your instance entirely instead of hardening it, see [Terminate Your Instance](/security/terminate-instance). Not sure which path to take? See the [Security Overview](/security/overview) for context.
</Note>

***

## Before you start

**Check if you're already exposed.** Look up your server's public IP on the [OpenClaw Exposure Watchboard](https://openclaw.allegro.earth/). If your instance appears there, it is actively reachable from the internet. Find your public IP with:

```bash theme={null}
curl -s https://ifconfig.me
```

If you are on the watchboard, assume your instance may have already been accessed and rotate all credentials after completing these steps.

***

## Step 1: Update OpenClaw

The single most impactful step is running a current version. Several critical vulnerabilities — including the [ClawJacked WebSocket hijack (CVE-2026-25253, CVSS 8.8)](https://thehackernews.com/2026/02/clawjacked-flaw-lets-malicious-sites.html) — were patched in v2026.2.25. Older versions remain vulnerable regardless of other hardening steps.

```bash theme={null}
openclaw update
```

Verify your version:

```bash theme={null}
openclaw --version
```

You should be on **v2026.2.25 or later**. The full list of security advisories is maintained on the [OpenClaw GitHub security page](https://github.com/openclaw/openclaw/security/advisories).

<Warning>
  Do not run `openclaw update` or `npm install -g openclaw` inside a running Coral sandbox — this causes a supervisord retry race and puts the instance into a FATAL state. Coral handles OpenClaw updates automatically.
</Warning>

***

## Step 2: Block the gateway port

This is the most impactful single step for instances running on a public VPS. OpenClaw's gateway listens on port 18789 by default. Blocking inbound access to this port from the internet makes your instance invisible to the scanners that found 258,305 exposed instances.

<Tabs>
  <Tab title="UFW (Ubuntu/Debian)">
    ```bash theme={null}
    sudo ufw default deny incoming
    sudo ufw allow ssh
    sudo ufw enable
    sudo ufw status
    ```

    If you need to allow access from a specific trusted IP only:

    ```bash theme={null}
    sudo ufw allow from YOUR_TRUSTED_IP to any port 18789
    ```
  </Tab>

  <Tab title="firewalld (RHEL/CentOS/Fedora)">
    ```bash theme={null}
    sudo firewall-cmd --set-default-zone=drop
    sudo firewall-cmd --permanent --add-service=ssh
    sudo firewall-cmd --reload
    sudo firewall-cmd --list-all
    ```
  </Tab>

  <Tab title="iptables">
    ```bash theme={null}
    # Drop all inbound except SSH
    sudo iptables -P INPUT DROP
    sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
    # Save rules
    sudo iptables-save > /etc/iptables/rules.v4
    ```
  </Tab>

  <Tab title="Cloud firewall console">
    Most cloud providers offer a network-level firewall (Security Groups, Firewall Rules, etc.) that blocks traffic before it reaches your server. This is often easier to manage than host-level firewall rules:

    * **AWS**: Edit the EC2 Security Group. Remove inbound rules for port 18789. See [AWS Security Groups documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html).
    * **DigitalOcean**: Use Cloud Firewalls in the networking section of your control panel. See [DigitalOcean Cloud Firewalls documentation](https://docs.digitalocean.com/products/networking/firewalls/).
    * **Hetzner**: Use Firewalls in the Hetzner Cloud Console. See [Hetzner Firewall documentation](https://docs.hetzner.com/cloud/firewalls/).
    * **Google Cloud**: Use VPC firewall rules. See [GCP Firewall documentation](https://cloud.google.com/firewall/docs/firewalls).
  </Tab>
</Tabs>

***

## Step 3: Bind the gateway to localhost

Even with a host firewall, configure OpenClaw itself to listen only on the loopback interface. This is a defense-in-depth measure: if a firewall rule is ever misconfigured or temporarily disabled, the gateway is not reachable from the network.

Edit `~/.openclaw/openclaw.json` (JSON5 format):

```json5 theme={null}
{
  gateway: {
    bind: "loopback"   // Only listen on 127.0.0.1
  }
}
```

Restart the gateway after making changes:

```bash theme={null}
openclaw restart
```

On versions prior to v2026.1.29, the default was `"all"` (binds to `0.0.0.0`). On v2026.1.29 and later, `"loopback"` is the default — verify your config explicitly if you upgraded from an older version.

***

## Step 4: Enable strong authentication

Verify that authentication is configured and set a strong auth token (32+ characters):

```bash theme={null}
openclaw config set auth.mode token
openclaw config set auth.token "$(openssl rand -hex 32)"
```

To view your current token:

```bash theme={null}
openclaw config get auth.token
```

<Warning>
  Do not reuse this token as a password anywhere else. Store it in a password manager. Anyone who obtains this token has full control of your agent and everything it's connected to.
</Warning>

***

## Step 5: Use zero-trust access for remote connections

If you need to access your instance remotely, use a zero-trust tunnel instead of opening ports. [Tailscale](https://tailscale.com/) is the most commonly cited option in community hardening guides — it creates an encrypted overlay network and makes your instance completely invisible to internet scanners.

Install Tailscale on your server:

```bash theme={null}
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
```

Once connected via Tailscale, access your OpenClaw gateway over the Tailscale IP. Your gateway remains bound to localhost; a local port forward through the Tailscale connection brings it to your client machine.

[WireGuard](https://www.wireguard.com/) is an alternative if you prefer to manage your own VPN infrastructure.

***

## Step 6: Put a reverse proxy in front

If you need public HTTPS access (e.g., for webhook integrations), put a reverse proxy in front of the gateway rather than exposing the gateway port directly. The proxy adds TLS termination, authentication headers, and rate limiting.

<Tabs>
  <Tab title="Caddy">
    Caddy handles TLS certificates automatically via Let's Encrypt.

    ```
    your-domain.example.com {
        basicauth /* {
            # Generate password hash: caddy hash-password
            youruser $2a$14$...hash...
        }
        reverse_proxy 127.0.0.1:18789
    }
    ```

    See [Caddy documentation](https://caddyserver.com/docs/) for full configuration options.
  </Tab>

  <Tab title="Nginx">
    ```nginx theme={null}
    server {
        listen 443 ssl;
        server_name your-domain.example.com;

        ssl_certificate /etc/letsencrypt/live/your-domain.example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/your-domain.example.com/privkey.pem;

        auth_basic "OpenClaw";
        auth_basic_user_file /etc/nginx/.htpasswd;

        location / {
            proxy_pass http://127.0.0.1:18789;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
        }
    }
    ```

    See [Nginx documentation](https://nginx.org/en/docs/) and [HAProxy's OpenClaw authentication guide](https://www.haproxy.com/blog/properly-securing-openclaw-with-authentication) for further options.
  </Tab>
</Tabs>

***

## Step 7: Lock down file permissions

OpenClaw credential files in `~/.openclaw/` are protected only by filesystem permissions. Restrict access:

```bash theme={null}
chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/credentials/*
chmod 600 ~/.openclaw/openclaw.json
```

Run OpenClaw under a dedicated non-root service user. Do not run as root or your personal user account:

```bash theme={null}
sudo useradd --system --shell /bin/false openclaw-svc
sudo -u openclaw-svc openclaw start
```

***

## Step 8: Audit and lock down skills

[Koi Security audited the ClawHub marketplace](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting) and found 341 malicious skills out of 2,857 reviewed. One of them was the #1 most-downloaded skill. The count later grew to 1,184 as more were identified.

For each installed skill:

1. Review the skill's source code before enabling it
2. Check the [ClawHavoc report](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting) for the skill name
3. Disable any skill you didn't explicitly install or can't verify

Disable automatic skill installation in `~/.openclaw/openclaw.json`:

```json5 theme={null}
{
  skills: {
    autoInstall: false
  }
}
```

Enable Docker sandbox isolation for tool execution (this limits the blast radius if a skill is malicious):

```bash theme={null}
openclaw config set sandbox.mode docker
```

***

## Step 9: Rotate all secrets

If your instance was ever publicly reachable — even briefly — assume that credentials may have been read. Rotate everything the agent had access to:

* **Gateway token** — Generate a new one as described in Step 4
* **LLM API keys** — OpenAI, Anthropic, Google, or any other provider key stored in `~/.openclaw/`
* **Connected account tokens** — Any OAuth tokens or API keys for integrations (Gmail, Slack, GitHub, Notion, etc.)
* **SSH keys** — If the agent had SSH access, generate new keys and remove old authorized keys

For each integration, revoke the old token/OAuth grant and create a new one with the minimum scope needed.

***

## Step 10: Ongoing monitoring

<AccordionGroup>
  <Accordion title="Enable audit logging">
    OpenClaw records session transcripts (tool calls, arguments, results) as local files. Enable and review these regularly:

    ```bash theme={null}
    openclaw config set logging.level audit
    ```

    For centralized logging (recommended if the host is shared), configure the optional OpenTelemetry exporter documented in the [OpenClaw docs](https://docs.openclaw.ai/).
  </Accordion>

  <Accordion title="Run the built-in security audit">
    OpenClaw ships a built-in security check command:

    ```bash theme={null}
    openclaw security audit --deep
    ```

    Run this after initial hardening and periodically thereafter. It checks authentication configuration, network binding, file permissions, and known-vulnerable skill versions.
  </Accordion>

  <Accordion title="Monitor for brute-force attempts">
    Install fail2ban to automatically block IPs that repeatedly fail authentication:

    ```bash theme={null}
    sudo apt-get install fail2ban
    ```

    Configure a jail for OpenClaw's auth log path. See the [fail2ban documentation](https://www.fail2ban.org/wiki/index.php/MANUAL_0_8) for setup details.
  </Accordion>

  <Accordion title="Pin versions and review changelogs">
    OpenClaw has had 90+ security advisories. Pin to a specific version and review the [release notes](https://github.com/openclaw/openclaw/releases) and [security advisories](https://github.com/openclaw/openclaw/security/advisories) before updating:

    ```bash theme={null}
    openclaw config set updates.auto false
    ```
  </Accordion>
</AccordionGroup>

***

## Community hardening guides

The security community published extensive hardening resources in response to the 2026 exposure crisis. The following guides are cited sources for this documentation:

* [DefectDojo: The OpenClaw Hardening Checklist — In-Depth Edition](https://defectdojo.com/blog/the-openclaw-hardening-checklist-in-depth-edition)
* [Clawctl: The Hardening Guide Nobody Wants to Write](https://clawctl.com/blog/openclaw-hardening-guide)
* [Penligent: A Practical Hardening and Validation Playbook](https://www.penligent.ai/hackinglabs/he/openclaw-security-risks-and-how-to-fix-them-a-practical-hardening-and-validation-playbook/)
* [Awesome Agents: How to Actually Secure OpenClaw](https://awesomeagents.ai/guides/how-to-secure-openclaw-hardening-guide/)
* [Brian Christner: OpenClaw Security Checklist](https://brianchristner.io/openclaw-security-checklist-hardening-your-ai-agent-infrastructure/)
* [Fernando Lucktemberg / AI Maker: OpenClaw Security Hardening Guide](https://aimaker.substack.com/p/openclaw-security-hardening-guide)
* [Easton: Secure OpenClaw Deployment](https://eastondev.com/blog/en/posts/ai/20260204-openclaw-secure-deployment/)
* [HAProxy: Properly Securing OpenClaw with Authentication](https://www.haproxy.com/blog/properly-securing-openclaw-with-authentication)

***

## Next steps

If you've completed the steps above but would rather move to a managed setup where this hardening is handled for you, see [how Coral approaches OpenClaw security](https://coral.inc/blog/2026-03-07-coral-security-architecture).

If you've decided to shut down your instance entirely, see [Terminate Your Instance](/security/terminate-instance).