How to secure OpenClaw on a server, and which hosts do it for you

The biggest OpenClaw risk lies in what you let it reach: your accounts, your files and any port left open to the internet. Keep its Gateway off the public internet and give the agent accounts and keys of its own. Then limit the commands it can run, and keep a backup you can restore before every update.

Every step below follows OpenClaw's own security, update and backup documentation, read on 27 October 2026.

What can go wrong, in plain words

OpenClaw is an agent that acts for you, so its risks are the risks of whatever it can touch. OpenClaw's own security guide works on one rule: one Gateway is one trust boundary. Do not share a Gateway between people who should not see each other's data. The main ways things go wrong:

• an open Gateway: someone on the internet reaches the control panel that drives your agent
• prompt injection: a web page, e-mail or file contains instructions the model obeys
• too much reach: the agent can send messages, run commands or spend money beyond what its job needs
• a bad update: an upgrade breaks a working set-up and there is no tested way back

Step 1: keep the Gateway off the internet

On a normal install on a server, OpenClaw's Gateway listens only on the server itself, so nobody on the internet can reach it. OpenClaw's security guide warns that its container images default to an exposed address instead, which then needs authentication. Reach the Gateway through an SSH tunnel or Tailscale, as OpenClaw's server guide does:

ssh -L 18789:localhost:18789 you@your-server
# then open http://localhost:18789 in your browser

Then run OpenClaw's own check, which looks for settings that have drifted from the safe defaults:

openclaw security audit

If you must let the Gateway listen on your local network or tailnet, it needs a shared secret. OpenClaw's guide names a token or a password, unless a trusted proxy handles sign-in. A firewall that allows only SSH is a sensible second layer.

Step 2: give the agent its own accounts and keys

Create separate accounts for the agent wherever you can: its own e-mail address, its own chat bot and its own API keys. If something goes wrong, you can then revoke the agent's access without locking yourself out.

In most chat channels, OpenClaw's defaults answer an unknown sender with a pairing code instead of obeying them. Keep pairing or an allowlist on, and do not switch direct messages to open. Its secrets commands show where keys are stored and which files hold credentials.

Step 3: limit what it can run

OpenClaw can run tools in a sandbox, give an agent read-only access, and ask for your approval before it runs a command. Its security guide also notes that an agent with the message tool can, by default, send messages across conversations and providers. Restrict that if your agent does not need it.

Treat anything the agent reads from outside, such as web pages, e-mails and files, as untrusted. OpenClaw's guide says the choice of model and the wrapping of untrusted input help limit prompt injection. It also says bypass flags should stay off in production.

Step 4: update safely, with a way back

OpenClaw ships new releases several times a week, and updates fix security problems. Updates can also break things. An open report in OpenClaw's tracker, filed on 19 September 2026, describes about 8 hours of recovery after an upgrade to version 2026.9.5.

OpenClaw's update guide says to create a verified backup before a significant update. It warns that a package rollback cannot undo changes already made to its databases. So back up first, preview the update, then apply it:

openclaw backup create
openclaw update --dry-run
openclaw update

A backup restores into a fresh folder, so your live set-up is never overwritten:

openclaw backup restore <archive.tar.gz> --target <fresh-folder>

For backups that run on their own, OpenClaw can keep a daily copy offsite:

openclaw backup enable --to offsite --every 24h --keep-daily 7

Step 5: cap what it can spend

Set a spending limit or a prepaid balance on every model API key the agent uses. Then a loop or an attack cannot run up a large bill.

What the one-click images say they set up

Four hosts we cover install OpenClaw for you. Their own pages describe the set-up in different detail, and none says how the Gateway is reached:

If a host's image runs OpenClaw in a container, remember OpenClaw's own warning: its container images listen on an exposed address by default. Pair that with a token or password, as its exposure runbook explains.

What a managed plan takes off your hands

On a managed plan the host handles the server side. Cloudways says it tests updates before applying them and keeps daily backups. Hosting.com patches, monitors and backs up its managed OpenClaw server. The agent's own settings, accounts and keys are still yours to secure.

The checklist on one page

Print this and tick it off on every server that runs OpenClaw:

• the Gateway listens only on the server, or behind a token and a trusted proxy
• you reach it through an SSH tunnel or Tailscale, and the firewall allows only SSH
• openclaw security audit reports no drift from the safe defaults
• the agent has its own e-mail, chat bot and API keys
• direct messages need pairing or an allowlist
• commands run in a sandbox or need your approval
• every model API key has a spending limit
• a backup runs daily, and you have restored one at least once
• you back up before each update and read the release notes

Security fixes come often: watch them

OpenClaw publishes security advisories on its GitHub page, with the version that fixes each one. Several rated high have concerned who may approve or run actions, which is exactly what an agent's safety rests on:

Back to OpenClaw hosting