Your OpenClaw might be compromised! Secure it now

1. Avoid Exposing Services Directly to the Public Network

When you need remote access to OpenClaw, never expose the service port directly to the public network. This can allow attackers to bypass the application layer, directly invoke high-risk features, execute arbitrary commands, steal sensitive data, or even completely take over the server. Consider the following two solutions:

• Solution 1: Nginx Reverse Proxy + Authenticated Access
  Configure an Nginx reverse proxy. Enable HTTPS certificates and set an IP address whitelist or identity authentication. Ensure only authorized users can access the service.
  

• Solution 2: Restrict Access Sources with an IP Address Whitelist
  Restrict OpenClaw access to specific IP addresses only. (For ECS, configure security groups. For simple application servers, set up an IP address whitelist in the firewall.)
  

2. Implement Identity Access Control

OpenClaw is designed for a "personal assistant" use case. Unlike multi-user cloud services such as Qianwen App, it operates by default with a single trusted user. Therefore, enable dmPolicy: allowlist in OpenClaw's channel configuration. This sets Direct Message (DM) access permissions to whitelist user IDs only.

Refer to the following configuration:

{
  channels: {
    <channel-name>: {
      ...
      dmPolicy: "allowlist", ## Set to allow direct messages only from specified IDs
      allowFrom: [<id>],## Whitelist, list authorized IDs
      ...
    },
  },
}

3. Use Third-Party Skills with Caution

The ClawHub plugin marketplace lets any user publish plugins. It lacks identity authentication and code review, posing a risk of malicious plugin injection. To ensure system security, follow these principles:

• Execute terminal commands with caution.
  Treat any curl, wget, bash commands, or Base64 decoded strings that require manual copy-pasting in Skill documents (SKILL.md/README.md) as high-risk signals. Legitimate plugins should not ask users to manually execute such complex commands to "fix the environment".
  

• Strictly control third-party plugins.
  Prioritize using OpenClaw's official, security-verified built-in skills. If you use a third-party skill, confirm its source and manually audit the code logic. Pay close attention to abnormal network requests and sensitive file read operations.
  

4. Restrict High-Risk Tools

OpenClaw includes powerful but high-risk operational capabilities (called Tools), such as:

• exec: Executes arbitrary commands on the server (such as deleting files or installing Trojans)

• browser: Launches a browser to automate web operations (such as logging on to accounts, taking screenshots, or stealing sessions)

• web_fetch: Sends requests to any URL (potentially used for private network probing or data exfiltration)

• gateway/nodes/cron: Involves remote scheduling and scheduled tasks, easily abused as a back door

If not required for business, disable high-risk Tools in openclaw.json, or set it to allow only specific Tools:

{
  "tools": {
    "allow": ["allowed tools", "allowed tools"]
    "deny": ["denied tools", "denied tools"]
  }
}

5. Strictly Protect Sensitive Credentials

OpenClaw deployment involves two types of critical credentials. If accidentally leaked, they could lead to service takeover or cloud resource abuse:

• OpenClaw Connection Token
  This token is used for identity authentication for WebSocket or local APIs. If obtained by others, it could invoke high-risk tools (such as exec and browser), affecting the robot's behavior. Use it only when necessary. Avoid sharing plaintext tokens with others. If you suspect a token leak, generate a new token by running clawdbot token reset.
  

• Large Language Model (LLM) API Key (such as Alibaba Cloud Model Studio Key)
  This key invokes Large Language Model (LLM) services. If leaked, it could consume your cloud quota, leading to additional costs. Create a RAM user with minimal permissions through Alibaba Cloud RAM. Grant only the necessary model invocation permissions.
  

To reduce risk, regularly rotate all sensitive credentials. Avoid using the same key long-term.

6. Update to the Latest Version Promptly

Early versions of OpenClaw had known security vulnerabilities—for example, high-risk tools such as exec and browser were enabled by default, and WebSocket connections did not enforce token authentication, which could be exploited through unauthorized access.

Starting with version 2026.2.9, OpenClaw uses a random service port by default. This helps hide the endpoint and reduces the risk of malicious scans. Upgrade to at least this version for basic security enhancements. If conditions allow, upgrade to the latest version for improved stability and mitigation capabilities.