OpenClaw Security Checklist: 14 Steps to Harden Your Setup

The threat landscape in 2026

Researchers reported over 40,000 OpenClaw instances reachable from the public internet. CVE-2026-25253 allows one-click RCE via crafted skill cards. ClawHavoc planted 341 malicious skills on ClawHub.

If you have not installed OpenClaw yet, bookmark this and follow it immediately after setup.

The 14-step security checklist

1. Update to OpenClaw 3.13 or later

openclaw --version
openclaw update --to 3.13

2. Set a strong gateway token

openclaw doctor --generate-gateway-token
openclaw config get gateway.auth.token

3. Bind the gateway to loopback only

openclaw config set gateway.bind loopback

4. Audit and remove untrusted ClawHub skills

openclaw skills list --installed
openclaw skills remove <skill-name>

5. Disable automatic skill approval

openclaw config set skills.auto_approve false

6. Run OpenClaw inside Docker

7. Secure your API keys

echo "ANTHROPIC_API_KEY=sk-ant-..." >> ~/.openclaw/.env
chmod 600 ~/.openclaw/.env

8. Set strict file permissions

chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/.env
chmod 600 ~/.openclaw/config.yaml

9. Disable unused channels

openclaw channels status
openclaw channels disable <channel-name>

10. Add firewall rules for the gateway port

11. Enable gateway TLS

12. Review agent permissions and tool access

13. Set up logging and monitoring

14. Schedule regular security reviews

Bottom line

Steps 1 through 5 are critical and take under ten minutes. The rest add defense-in-depth. See our NemoClaw comparison for enterprise security alternatives.