Why Security Is Critical
OpenClaw is extraordinary software. As one of the most popular open-source personal AI assistant platforms, it has grown rapidly. But popularity has a dark side: it makes OpenClaw a high-value target for attackers, and the default installation is alarmingly insecure.
Independent security research conducted in early 2026 used Shodan and Censys scans to identify large numbers of OpenClaw instances directly accessible from the public internet. A substantial share had no authentication configured whatsoever, meaning anyone with the IP address could send messages, read conversation history, access connected integrations, and in many cases execute arbitrary commands through the AI assistant.
The $6,000 overnight bill is not hypothetical. It happened to a developer who posted about it on Reddit in February 2026. An attacker found their exposed instance, extracted the OpenAI and Anthropic API keys from the conversation context, and ran automated requests through both APIs for 14 hours before the developer woke up to billing alerts. The API providers refunded part of it, but not all. The developer had no backups and lost 6 months of conversation history and custom configurations.
This is not a criticism of OpenClaw itself. The core software is well-maintained, actively developed, and responsibly disclosed when vulnerabilities are found. The problem is deployment. OpenClaw's one-liner installer prioritizes ease of setup (get running in 5 minutes) and leaves security configuration to the user. Most users are not system administrators. They follow the quickstart guide, see it working, and move on. That is when the clock starts ticking.
The gap between "installed and working" and "installed and secure" is exactly what OpenClawPro exists to close. Below, we detail every step of our 12-point security audit, the same process we apply to every installation, starting from the $169 Starter plan.
Our 12-Point Security Audit
Every OpenClawPro installation, from the $169 Starter plan to the Managed tier, receives this complete security hardening. Each point addresses a specific attack vector that we have observed exploited in the wild. Nothing is optional. Nothing is skipped.
SSH Key-Only Authentication
Disable password login entirely
Password-based SSH is the single most attacked vector on any VPS. Automated bots hammer port 22 thousands of times per hour, trying common passwords and brute-forcing weak ones. We generate an Ed25519 SSH key pair for you, install the public key on your server, and permanently disable PasswordAuthentication in /etc/ssh/sshd_config. This makes brute-force attacks impractical: there is nothing to guess.
Fail2ban Configuration
Brute-force protection that bans attackers
Even with key-only SSH, persistent bots waste bandwidth and clutter logs. Fail2ban watches authentication logs in real-time and automatically bans IP addresses after 3 failed attempts for 24 hours. We configure jails for SSH, HTTP auth, and OpenClaw-specific endpoints. Repeat offenders get permanent bans. This significantly reduces malicious traffic in the first week.
UFW Firewall Rules
Allow only ports 22, 80, and 443
A default-deny firewall is your first line of defense. We enable UFW (Uncomplicated Firewall) with deny-all incoming by default, then explicitly allow only three ports: 22 (SSH), 80 (HTTP for Let's Encrypt), and 443 (HTTPS). Every other port (including database ports, Docker daemon, Redis, and debug interfaces) is silently dropped. No response, no connection, no footprint.
Automatic Security Updates
unattended-upgrades for zero-day patches
Critical CVEs get patched within hours of disclosure, but only if your system is configured to apply them. We install and configure unattended-upgrades to automatically apply security patches from the official Ubuntu/Debian security repository every 6 hours. Kernel updates trigger automatic reboots during a maintenance window you choose (default: 4 AM UTC). You stay patched without lifting a finger.
Docker/Podman Sandboxing
No --privileged flag, ever
Running containers with --privileged gives them full root access to the host machine; it defeats the entire purpose of containerization. We run OpenClaw with the minimum required capabilities (NET_BIND_SERVICE only), a read-only root filesystem where possible, no-new-privileges security option, and isolated networking. The container cannot access the host's devices, kernel modules, or other containers.
Non-Root User for OpenClaw
Principle of least privilege
OpenClaw never runs as root. We create a dedicated system user (openclaw) with no login shell, no sudo access, and ownership only of the directories it needs. If an attacker somehow compromises the OpenClaw process, they are confined to a powerless user account with no ability to escalate privileges, modify system files, or install packages.
Environment Variable Encryption
.env permissions locked to 600
Your .env file contains API keys worth hundreds of dollars: OpenAI, Anthropic, Google, Stripe. A single leaked key can run up a $6,000 bill overnight. We set file permissions to 600 (owner read/write only), owned by the openclaw user. The file is excluded from all backup scripts and version control. We also configure Docker secrets for production deployments where .env files are insufficient.
Rate Limiting on API Endpoints
Prevent abuse and cost overruns
An unprotected OpenClaw API endpoint is a free AI gateway for anyone who finds it. We configure nginx rate limiting at 30 requests/minute for chat endpoints, 5 requests/minute for auth endpoints, and 100 requests/minute for static assets. Burst allowances handle legitimate spikes. Custom rate-limit headers tell clients exactly how many requests remain. Excessive requests get 429 responses, not expensive AI completions.
CORS Policy Configuration
Restrict cross-origin access
Without CORS configuration, any website on the internet can make requests to your OpenClaw instance through a visitor's browser. We configure strict CORS headers: only your specific domains are allowed as origins, credentials require explicit opt-in, and preflight responses are cached for 24 hours. This prevents cross-site request forgery and unauthorized API access from malicious websites.
SSL/TLS with Auto-Renewal
Let's Encrypt certificates, always valid
Every OpenClawPro installation gets HTTPS from day one using Let's Encrypt certificates. We configure Certbot with automatic renewal 30 days before expiry, HTTP-to-HTTPS redirect, HSTS headers with a 1-year max-age, TLS 1.2 minimum (TLS 1.3 preferred), and an A+ rating on SSL Labs. No mixed content warnings, no certificate expiry downtime, no excuses.
Log Rotation and Monitoring
Detect intrusions before damage occurs
Logs are your security camera footage. We configure logrotate for all OpenClaw, nginx, and system logs with 30-day retention and compression. More importantly, we set up log monitoring with alerts: failed SSH attempts beyond threshold, unusual API usage patterns, container restart loops, and disk space warnings at 80%. You get notified via your configured messaging channel (Telegram, Discord, etc.) when something looks wrong.
Backup Strategy
Automated daily snapshots
A security incident without backups is a catastrophe. With backups, it is an inconvenience. We configure automated daily snapshots of your OpenClaw data directory, Docker volumes, and configuration files. Backups are compressed, encrypted with AES-256, and stored in a separate location (either a different directory for VPS snapshots or an S3-compatible bucket). We keep 7 daily, 4 weekly, and 3 monthly backups. Restoration is tested during installation.
Real Threats
These are not theoretical attack vectors. Every threat described below has been observed in the wild against OpenClaw deployments in 2025-2026. We track them so you do not have to.
ClawBleed: cross-site WebSocket hijack (CVE-2026-25253)
CRITICAL · CVSS 8.8 (HIGH)ClawBleed (CVE-2026-25253) is a real, actively-exploited OpenClaw vulnerability rated CVSS 8.8 (HIGH). Per the NVD, OpenClaw (also known as clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
In practice this is a cross-site WebSocket hijack: a victim who clicks a crafted link causes their instance to open an attacker-controlled WebSocket and leak its auth token, enabling one-click remote code execution and auth-token theft. Exploitation in the wild is confirmed (NVD; CCB Belgium advisory).
Sources: NVD · CVE-2026-25253 (CVSS 8.8 · patched v2026.1.29, 2026-01-30 · disclosed 2026-02-03) · CCB Belgium advisory · CVE tracker
ClawHavoc: malicious skills on ClawHub
HIGH RISKIn the supply-chain campaign nicknamed ClawHavoc (Antiy CERT, February 2026), researchers found 1,184+ malicious skills on ClawHub totalling roughly 247,000 installs, several distributing the Atomic macOS Stealer (AMOS). They range from credential-harvesting skills that exfiltrate API keys to cryptominers that quietly consume your server's CPU, to backdoors that open reverse shells on installation. ClawHavoc is distinct from the ClawBleed (CVE-2026-25253) WebSocket vulnerability above.
The ClawHub team has improved moderation significantly, but the review backlog means newly published skills may remain unvetted for 48-72 hours. We recommend installing only skills with 100+ downloads, verified publisher badges, and source code you have personally reviewed. OpenClawPro installations include a curated allowlist of 50 verified, audited skills.
Source: Antiy CERT, ClawHavoc supply-chain research, February 2026 (1,184+ malicious skills, ~247,693 installs)
Prompt Injection Attacks
MEDIUM RISKWhen OpenClaw processes external data (emails, web pages, documents), that data can contain hidden instructions that manipulate the AI's behavior. A carefully crafted email could instruct OpenClaw to forward all future messages to an attacker's address, or a malicious web page could tell it to reveal its system prompt and API configuration.
OpenClaw v2026.2+ includes basic prompt injection detection, but it is not foolproof. OpenClawPro deployments add an additional input sanitization layer and configure the system prompt with explicit anti-injection directives that significantly reduce the success rate of these attacks.
Token Theft via OAuth Misconfiguration
MEDIUM RISKOpenClaw integrates with services like Google Calendar, GitHub, Notion, and Linear through OAuth tokens. A common misconfiguration stores these tokens in plain text within the SQLite database or Docker volume with overly permissive file access. If any other service on the server is compromised, those tokens provide access to every connected account.
Worse, many users configure OAuth tokens with overly broad scopes, granting "full access" when "read-only" would suffice. OpenClawPro configures each integration with the minimum required scope and stores tokens in an encrypted credential store rather than plain text in the database.
Security Verification Checklist
Run these commands on your server right now to check your security posture. Each command verifies one of the critical hardening steps. If any result does not match the expected output, your installation has a vulnerability that needs immediate attention.
Check open ports
Expected: You should only see ports 22, 80, and 443
Verify Fail2ban is active
Expected: Should show active jails for sshd at minimum
Check UFW firewall status
Expected: Status: active, Default: deny (incoming), allow (outgoing)
Docker privilege check
Expected: Must return "false", never "true"
.env file permission check
Expected: Should show "600 openclaw", not 644 or root
We Do This For You
Every OpenClawPro installation includes the complete 12-point security audit described on this page. No shortcuts. No "we'll get to it later." Your server is hardened before we hand you the keys.
Frequently Asked Questions
Common questions about OpenClaw security, our audit process, and how we handle sensitive data during installation.