OpenClaw Security Checklist: 14 Steps to Harden Your Setup
Over 40,000 OpenClaw instances are exposed to the internet right now. A critical RCE vulnerability, a malware campaign with hundreds of poisoned skills, and weak default settings have put thousands of users at risk. This is the step-by-step hardening guide that should have existed months ago.
The threat landscape in 2026
Researchers reported over 40,000 OpenClaw instances reachable from the public internet. CVE-2026-25253 allows one-click RCE via crafted skill cards. ClawHavoc planted 341 malicious skills on ClawHub.
If you have not installed OpenClaw yet, bookmark this and follow it immediately after setup.
The 14-step security checklist
1. Update to OpenClaw 3.13 or later
openclaw --version
openclaw update --to 3.132. Set a strong gateway token
openclaw doctor --generate-gateway-token
openclaw config get gateway.auth.token3. Bind the gateway to loopback only
openclaw config set gateway.bind loopback4. Audit and remove untrusted ClawHub skills
openclaw skills list --installed
openclaw skills remove <skill-name>5. Disable automatic skill approval
openclaw config set skills.auto_approve false6. Run OpenClaw inside Docker
7. Secure your API keys
echo "ANTHROPIC_API_KEY=sk-ant-..." >> ~/.openclaw/.env
chmod 600 ~/.openclaw/.env8. Set strict file permissions
chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/.env
chmod 600 ~/.openclaw/config.yaml9. Disable unused channels
openclaw channels status
openclaw channels disable <channel-name>10. Add firewall rules for the gateway port
11. Enable gateway TLS
12. Review agent permissions and tool access
13. Set up logging and monitoring
14. Schedule regular security reviews
Bottom line
Steps 1 through 5 are critical and take under ten minutes. The rest add defense-in-depth. See our NemoClaw comparison for enterprise security alternatives.
Need OpenClaw fixed live?
Remote rescue sessions for gateway, auth, tunnel, VPS, and model access problems.
See Rescue Session