How to secure a self-hosted n8n server, and which hosts do it for you

Secure a self-hosted n8n server in this order. Update it promptly. Keep the editor and its webhooks behind HTTPS and a login. Protect the encryption key that guards your saved credentials.

Updates come first because n8n fixes security flaws often. Its GitHub page lists 211 security advisories from 2026 up to 27 October, 19 of them rated critical.

We also read what four hosts' own pages say their ready-made n8n servers set up. Two say the editor comes with HTTPS, and none of the four mentions a firewall, so check the open ports yourself. Every step below links to n8n's own documentation, read on 27 October 2026.

What can go wrong, in plain words

n8n holds the keys to everything it connects: e-mail accounts, payment services, databases and AI providers. Someone who reaches the editor, or a flaw that lets them run code on the server, reaches those keys too.

• an old version: most critical advisories this year let an attacker run code on the server. Each was fixed in a release, so a server that is not updated keeps the hole open
• an editor open to the internet over plain HTTP, or on its own port 5678, past the firewall
• a webhook with no authentication that starts a workflow anyone can trigger
• the encryption key lost or leaked: without it, a backup of your credentials cannot be read; with it, anyone can read them
• nodes that run commands or touch files, used by people who should not have that power

Step 1: update promptly, with a backup you have restored

n8n publishes fixes for the current release line and, for now, the 1.x line too. Pick one line and update within days of a security release. The dated list below shows why. Before each update, take a backup that includes the encryption key, as our guide to installing n8n with Docker explains. Restore it once somewhere else, so you know it works.

Step 2: HTTPS and a login in front of the editor

n8n listens on port 5678. Its documentation recommends a reverse proxy, such as Traefik or Caddy, that serves HTTPS and renews the certificate; n8n itself then stays on the server. Two checks matter:

• from outside, only ports 22, 80 and 443 should answer: port 5678 must not
• if n8n runs in Docker, publish its port on 127.0.0.1 only (127.0.0.1:5678:5678), because Docker opens a published port on every address, past a ufw firewall

Then turn on two-factor authentication for every user, and as owner enforce it in the security policies. Create the owner account straight after the install. Hostinger's n8n template, for example, asks for it on the first visit to the address, so the first person to open it sets it up.

# from another computer: only 22, 80 and 443 should be open
nmap -Pn -p 22,80,443,5678 n8n.example.com

# in docker-compose.yml: keep n8n on the server itself
#   ports:
#     - "127.0.0.1:5678:5678"

Step 3: decide which webhooks the internet may reach

A webhook is an address that starts a workflow when something calls it, so it must be public to work. Give each one authentication: the Webhook node offers basic auth, header auth, JWT auth and n8n user auth, or None. Use None only when the caller cannot send a secret, and then check the incoming data inside the workflow.

Behind a proxy, set the public address with N8N_WEBHOOK_URL, which replaced WEBHOOK_URL in n8n 2.35.0. Otherwise the webhook addresses n8n shows point at the wrong place.

Step 4: protect the encryption key and your credentials

n8n encrypts saved credentials with a key. On a server you control, set it yourself with N8N_ENCRYPTION_KEY. Keep a copy outside the server and put it in every backup: a backup restored with a different key leaves every credential unreadable. From n8n 3.0 the owner can rotate the data key under Settings, Data Encryption Keys; on 2.x this needs N8N_ENV_FEAT_ENCRYPTION_KEY_ROTATION=true first.

• give each workflow its own credentials, with the narrowest rights the provider allows
• remove credentials no workflow uses: the security audit lists them
• keep the server's own login for admins only, with SSH keys instead of passwords

Step 5: switch off what you do not use

• the public API: N8N_PUBLIC_API_DISABLED=true, and its playground with N8N_PUBLIC_API_SWAGGERUI_DISABLED=true. n8n recommends this when you do not use the API
• nodes that run commands or touch files: NODES_EXCLUDE blocks them. Execute Command is already blocked by default
• requests to your private network from workflows: N8N_SSRF_PROTECTION_ENABLED=true (from n8n 2.12.0) blocks private, loopback and link-local addresses unless you allow them
• Code node isolation: run task runners in external mode, in their own container, as n8n's hardening page describes

N8N_PUBLIC_API_DISABLED=true
N8N_PUBLIC_API_SWAGGERUI_DISABLED=true
NODES_EXCLUDE='["n8n-nodes-base.executeCommand","n8n-nodes-base.readWriteFile"]'
N8N_SSRF_PROTECTION_ENABLED=true

AI steps can also run up a bill. Set a spending limit at the model provider, as our guide to AI spending limits shows.

Check it: n8n's own security audit

n8n can audit itself. Run n8n audit on the server, or use the n8n node with Resource Audit. It reports unused credentials, risky SQL expressions, nodes that touch the file system or run code, unprotected webhooks, missing security settings and an outdated version. Run it after each change and after each update.

n8n audit
# in Docker:
docker exec -it n8n n8n audit

What the hosts' ready-made n8n servers set up, by their own pages

Four of the hosts we cover install n8n for you. The table shows what each host's own pages say, read on 27 October 2026. Where a page says nothing, check it on your server.

What managed n8n and n8n Cloud take off your hands

On n8n Cloud, n8n runs, updates and secures the server; you still choose who gets access and how each webhook is protected. A managed plan from a hosting company sits in between. ScalaHosting's managed n8n, by its own page, runs PostgreSQL with a Redis queue, takes daily off-site backups and can install n8n updates for you.

The checklist on one page

1. Update within days of a security release, after a backup that includes the encryption key.
2. Serve the editor over HTTPS through a reverse proxy; keep port 5678 closed to the internet.
3. Turn on two-factor authentication for every user and create the owner account at once.
4. Give every webhook authentication, or check its input inside the workflow.
5. Set your own encryption key, keep a copy off the server, and rotate it on n8n 3.0 or later.
6. Turn off the public API, block command and file nodes, and turn on SSRF protection.
7. Run n8n audit after each change and after each update.

How we checked

We read n8n's security documentation and the hosts' pages on 27 October 2026. On the same day we counted n8n's security advisories through GitHub's own interface. Our own measurements will be added here, with their dates, when our test bench runs them.

Back to n8n hosting