How to secure your self-hosted n8n server

By the serverserv team · 8 min read · Updated 21 October 2026

Put n8n behind HTTPS, create the owner account straight away, close every port except SSH, 80 and 443, use SSH keys, keep the server and n8n updated, and back up the n8n data volume. Here are the 9 steps in order.

The 9 steps

1. Claim the owner account immediately. A fresh n8n with no owner can be claimed by anyone who reaches it first.
2. Serve it only over HTTPS. The official n8n Docker Compose setup puts n8n behind Traefik with a free Let's Encrypt certificate and binds n8n itself to 127.0.0.1:5678, so it is never exposed directly.
3. Open only the ports you need. With UFW, allow OpenSSH, 80 and 443 and deny everything else.
4. Use SSH keys, not passwords, and switch off password login once your key works.
5. Turn on two-factor login for every n8n user.
6. Protect your webhooks. Add header or basic authentication to any webhook that triggers real actions.
7. Keep settings file permissions strict with N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true, and limit file access with N8N_RESTRICT_FILE_ACCESS_TO.
8. Update regularly: docker compose pull && docker compose up -d for n8n, plus automatic security updates for the operating system.
9. Back up the n8n_data volume and keep a copy off the server, because it holds your workflows and credentials.

Comparing hosting options first? Read n8n Cloud vs self-hosted n8n.

Quick checklist

Check	How to confirm it
n8n only reachable over HTTPS	Opening http:// redirects to https://, and port 5678 is not reachable from outside
Owner account claimed	The setup page asks you to log in instead of creating an owner
Firewall on	sudo ufw status shows only OpenSSH, 80 and 443 allowed
Password login for SSH off	PasswordAuthentication no in your SSH settings
Two-factor login on	Each user sees a code prompt after the password
Webhooks protected	Calling a webhook without the header or password returns an error
Backups working	You can restore last night's copy of the n8n data volume on a test server

Common mistakes

• Publishing port 5678 straight to the internet with Docker. Docker can bypass UFW rules, so bind n8n to 127.0.0.1 and put a reverse proxy in front.
• Leaving a fresh install unclaimed while you finish other setup steps.
• Storing API keys in workflow notes or code nodes instead of n8n credentials, where they are encrypted.
• Never testing a restore. A backup you have not restored once is a guess.
• Skipping updates for months. Security fixes arrive in regular releases, so plan a monthly update.

Questions

Sources

• n8n Docker Compose setup
• n8n security environment variables