OpenClaw security checklist: how to run your agent on a VPS without exposing it

By the serverserv team · 8 min read · Updated 28 October 2026

Most OpenClaw security problems in 2026 did not come from clever hacking. They came from Gateways left open to the internet, old versions that were never updated and skills installed without a second look. This checklist covers the ten steps that close those gaps on a Linux VPS, in the order we would do them.

Why OpenClaw security matters

OpenClaw is an agent with real access: it reads your messages, can browse the web, run tools and act on accounts you connect. That makes a misconfigured server more serious than a misconfigured website.

A few numbers from 2026 show what goes wrong:

• Exposed Gateways. Internet scans in early February found more than 40,000 OpenClaw instances reachable from the public internet, and follow-up scans reported over 135,000. Many used a Docker setup that listens on all network interfaces by default.
• Old versions. CVE-2026-25253, rated 8.8, let a crafted link leak the Gateway token. It was fixed in version 2026.1.29 at the end of January, but servers that were never updated stayed vulnerable.
• Malicious skills. In the "ClawHavoc" campaign, researchers found 341 malicious skills out of 2,857 they checked on ClawHub, most of them delivering password-stealing malware.

None of this means OpenClaw is unsafe to use. It means it needs the same care as any server that holds keys to your accounts.

1. Update OpenClaw core and plugins

Update first, because many published fixes ship in plugins, not only in the core package.

openclaw update
openclaw plugins update --all
openclaw --version

Check the version against the current stable release on the OpenClaw GitHub page. Then keep the server's operating system patched too: on Ubuntu, sudo apt update && sudo apt upgrade -y, and turn on unattended-upgrades for security fixes.

2. Keep the Gateway on localhost

The Gateway (port 18789 in most setups) should only listen on the server itself, never on its public address.

openclaw config set gateway.bind loopback
openclaw gateway restart

On the server, ss -tlnp | grep 18789 should show 127.0.0.1:18789, not 0.0.0.0:18789. If you run OpenClaw in Docker, publish the port as 127.0.0.1:18789:18789. A plain 18789:18789 mapping exposes it to the world, and Docker's port rules can bypass a UFW firewall.

3. Check from outside, not just from the server

Checking on the server only tells you how the Gateway is bound. To be sure it is private, test from another machine.

nmap -sT -p 18789 YOUR.SERVER.IP

The port should show as closed or filtered. If it shows as open, fix the bind or the Docker mapping before doing anything else, and rotate the Gateway token, since it may have been seen.

4. Reach the dashboard through an SSH tunnel

You do not need to open the Gateway to use the dashboard from your laptop. Forward it over SSH instead:

ssh -L 18789:127.0.0.1:18789 [email protected]

Then open http://localhost:18789 in your browser while the SSH session is running. A private network such as Tailscale works too. If you put a reverse proxy in front, list it in gateway.trustedProxies and protect it with a login.

5. Lock down SSH and the firewall

The server's front door matters as much as the agent.

• Log in with SSH keys and turn off password logins (PasswordAuthentication no in /etc/ssh/sshd_config).
• Turn off direct root login (PermitRootLogin no) and use a normal user with sudo.
• Allow only what you need: ufw default deny incoming, ufw allow 22/tcp, ufw enable.
• Add fail2ban to slow down password guessing.

Our Linux VPS security guide walks through each of these step by step.

6. Vet every skill before you install it

A skill is code that runs with your agent's permissions. Treat it like installing software from a stranger.

• Install only what you need, from authors you can identify.
• Run openclaw skills verify @owner/name before installing, and read the skill's files.
• Be wary of skills that ask you to run a command or download a "helper" outside OpenClaw. That was the trick behind most ClawHavoc skills.
• Review your installed skills and connected tools once a month and remove what you no longer use.

7. Limit what the agent can touch

Prompt injection, where a web page or email tricks the agent into doing something you did not ask for, cannot be fully prevented by settings. What you can control is how much damage it could do.

• Restrict file access to the folders the agent actually needs.
• Allow only the shell commands it needs, or none at all.
• Give connected accounts the narrowest permissions possible, for example read-only access to email.
• Use a separate account for the agent rather than your main one, where you can.
• Use OpenClaw's sandboxing for tasks that run code.

8. Protect your API keys and tokens

Your model keys and the Gateway token are what an attacker would want first.

• Use OpenClaw's secret references instead of pasting keys into plain config files, and run openclaw secrets audit --check.
• Set a monthly spending limit with your model provider, so a stolen key cannot run up an unlimited bill.
• Rotate the Gateway token if the server was ever reachable from the internet.
• Never share screenshots or logs that show tokens.

9. Run the built-in security audit

OpenClaw includes an audit command that checks for common mistakes.

openclaw security audit --deep

Fix every critical and warning item it reports, then run it again after each update. A weekly reminder is a good habit.

10. Back up and plan for a bad day

If something does go wrong, you want to be able to start clean quickly.

• Back up your OpenClaw configuration and workspace regularly, and keep a copy off the server.
• Know how to revoke your model keys and disconnect channels in a hurry.
• If you suspect a compromise, take the server offline, rotate every key and token, and rebuild from a known good backup rather than trying to clean it in place.

When we set up serverserv OpenClaw hosting for you, we keep the Gateway on localhost, turn on the firewall and set up your first agent task with you, so the basics are right from day one. If you would rather not look after the server, a managed VPS puts operating system updates, hardening and monitoring in our hands.

Questions

Sources

• Clawdocs: known OpenClaw vulnerabilities, incidents and hardening (October 2026)
• OpenClaw security advisories on GitHub
• OpenClaw documentation
• Bitdoze: OpenClaw security guide, CVE-2026-25253 and malicious skills
• Claude Market: OpenClaw security hardening checklist

Prices from other companies are as published at the time of writing and can change.