OpenClaw Security Checklist: Lock It Down Before You Connect Anything

Hardening an OpenClaw install means shrinking what a manipulated or misconfigured agent can reach. Work through eleven steps in order: isolate the machine, update, apply the hardened baseline config, keep the gateway private, and control who can message it. Then restrict its tools, turn on sandboxing, treat plugins as code, protect secrets, run the built-in audit, and write an incident plan. Every setting and command below comes from OpenClaw’s own documentation, read on 17 to 19 October 2026 against release v2026.10.5, with the isolation advice backed by Malwarebytes.

This checklist lowers risk. It does not make OpenClaw safe for sensitive data. Sandboxing is “not a perfect security boundary” in the project’s own words, and the guide on whether OpenClaw is safe for business explains who should not use it at all. Finish the checklist before you connect any chat app, account, or file.

Key Takeaways
Start from the official “hardened baseline” config: loopback-only gateway, token auth, paired DMs, a restricted tool profile, no command execution, and no elevated mode.
Sandboxing is off by default. Turn it on with agents.defaults.sandbox, and use mode all if the main session should be sandboxed too.
openclaw security audit checks for drift from safe defaults. Run it after every config change and every update.
Plugins and skills run as trusted code. Allowlist them, pin exact versions, and read the source before enabling.
Keep a rollback and credential-rotation plan written down before you need it.

Before You Start

This checklist assumes a regular host install with one trusted operator, which is the setup OpenClaw’s security model supports. The docs state the rule plainly: one gateway is one trust boundary, “a single operator, or a team whose members trust each other” (security overview, retrieved 2026-10-19). If staff, contractors, or clients who do not trust each other need access, run separate gateways, credentials, and ideally separate OS users or hosts.

Three limits to keep in mind throughout:

The checklist reduces risk. It does not remove prompt injection, which the docs treat as a standing threat.
Settings change between releases. Check the linked docs page before you copy a value.
Never connect the data on the “never connect” list in the guide, whatever the settings.

Step 1: Isolate the Host

Put OpenClaw on a machine or virtual machine that holds nothing you cannot lose. Do not use the computer where you are signed in to banking, email, or your admin accounts.

Use a dedicated spare computer, a virtual machine, or a dedicated server.
Create a separate OS user account for the gateway. The secrets documentation recommends “a dedicated OS user account for the Gateway if the host is shared.”
Turn on full-disk encryption on the gateway host, as the same page advises.
Give the agent its own accounts and API keys with the narrowest permissions, never your personal or admin logins. Malwarebytes’ OpenClaw analysis recommends a sandboxed VM or container on an isolated host, default-deny network egress, separate non-human identities with least privilege and short token lifetimes, and no direct access to production secrets.
Prefer one OS user, host, or server per trust boundary, per the trust model.

Step 2: Update and Verify

OpenClaw ships updates frequently, and the project has published hundreds of security advisories, so an old install is a risk. The latest release when this was written was v2026.10.5, published 18 October 2026.

openclaw update status
openclaw update --dry-run
openclaw update
openclaw doctor

These commands come from the update reference and the doctor reference. openclaw update status shows where you are, --dry-run previews the change, and openclaw doctor runs health checks afterward. Before relying on any version, open the project’s security advisories and check which release fixed the issues that matter to you.

Docker or other container installs need extra care: the docs say container images default to an exposed bind, so apply Step 4 before first start.

Step 3: Apply the Hardened Baseline

OpenClaw documents a “hardened baseline in 60 seconds” that keeps the gateway local, isolates DMs, and turns off the riskiest tools. The config lives in ~/.openclaw/openclaw.json. This is the official example from the hardened baselines page (retrieved 2026-10-19):

{
  gateway: {
    mode: "local",
    bind: "loopback",
    auth: { mode: "token", token: "replace-with-long-random-token" },
  },
  session: {
    dmScope: "per-channel-peer",
  },
  tools: {
    profile: "messaging",
    deny: ["group:automation", "group:runtime", "group:fs", "sessions_spawn", "sessions_send"],
    fs: { workspaceOnly: true },
    exec: { security: "deny", ask: "always" },
    elevated: { enabled: false },
    sessions: { visibility: "agent" },
    agentToAgent: { enabled: false },
  },
  channels: {
    whatsapp: { dmPolicy: "pairing", groups: { "*": { requireMention: true } } },
  },
}

Setting	What it does
`gateway.bind: "loopback"`	Only the local machine can reach the gateway.
`gateway.auth` (token mode)	Callers must present a long random token.
`session.dmScope: "per-channel-peer"`	Each sender’s direct messages stay in a separate session.
`tools.profile: "messaging"`	Starts from a restricted, messaging-oriented tool set.
`tools.deny`	Blocks automation, runtime, and file-system tool groups, plus session spawning and sending.
`tools.exec` (deny, ask always)	Blocks command execution, and requires approval if you ever allow it.
`tools.elevated.enabled: false`	Turns off the escape hatch that runs commands outside the sandbox.
`channels.whatsapp.dmPolicy: "pairing"`	Unknown senders must pair before they can message the agent.

Replace the placeholder token with a real secret. The network exposure docs give openssl rand -hex 32 as an example, and a password manager’s generator works too. The gateway rejects blank tokens and placeholder strings.

A baseline this tight means the agent can do very little. That is deliberate. The docs say to “re-enable tools selectively per trusted agent from there,” one at a time, and only after the later steps are done.

Step 4: Keep the Gateway Private

On a regular host install the gateway listens on loopback, and authentication is required by default. The network exposure docs say the gateway “refuses WebSocket connections” when no valid auth path is configured. Keep it that way.

Leave gateway.bind on "loopback". The other values ("lan", "tailnet", "custom") make it reachable by more clients and should only be used with gateway auth and a real firewall.
Never port-forward it to the internet. The exposure runbook says to avoid direct public port-forwarding.
For remote access, use the narrowest pattern. The runbook lists a loopback gateway reached through an SSH tunnel, or Tailscale Serve for a personal tailnet, as the recommended patterns for personal use.
Keep local network discovery off. The docs advise keeping the Bonjour plugin disabled unless you need LAN discovery, because it broadcasts operational details.
Containers: set the bind and add authentication before the first start, since container images default to an exposed bind.

Before opening any access beyond loopback, follow the runbook’s baseline checks: openclaw doctor, openclaw security audit, openclaw security audit --deep, and openclaw health. Its own rule is blunt: “When in doubt, return to loopback-only access and re-run the audit.”

Step 5: Control Who Can Message It

Every message to the agent is untrusted input. The README says so directly. The access control docs describe four DM policies: pairing (the default, where unknown senders get a code and are ignored until approved), allowlist, open, and disabled.

Keep dmPolicy on pairing or allowlist. Treat open as a deliberate opt-in and avoid it.
Review pairing requests yourself. openclaw pairing list <channel> shows them, and openclaw pairing approve <channel> <code> approves one.
Do not use "*" allowlists with broad tools. The runbook is explicit about this.
Require a mention in groups (requireMention: true), and use sender allowlists in any room where strangers can post.
Set session.dmScope to per-channel-peer when more than one person can message the bot, so their conversations do not share context.
Filter quoted context with contextVisibility. Set it to allowlist so text from non-allowlisted senders does not reach the model.
Use a separate phone number for the bot on number-based channels like WhatsApp, so personal chats stay private, as the baseline page suggests.

One caution from the docs: pairing approves a sender to trigger the bot. It “does not make that sender a separate host security boundary.”

Step 6: Restrict Tools

The agent’s damage potential equals the tools you give it. The baseline from Step 3 already denies most of them. Beyond that, follow the tool permissions guidance:

Deny the control-plane tools for any agent that handles untrusted content: gateway, cron, sessions_spawn, and sessions_send. The docs show this exact deny list.
Keep command execution denied. tools.exec.security: "deny" blocks all exec calls. If you must allow something, choose the specific senders, agents, commands, and approval mode first, and keep ask on.
Leave elevated mode off. tools.elevated runs commands outside the sandbox, so keep tools.elevated.enabled: false and, if you ever enable it, keep allowFrom tight.
Confine file access with tools.fs.workspaceOnly: true, and keep agent workspaces narrow. Do not use your home directory as a workspace, since it can expose the ~/.openclaw state folder.
Avoid browser, canvas, node, cron, gateway, and session-spawn tools on open or semi-open messaging surfaces, per the runbook.
Do not pair nodes you do not need. A paired macOS node can run system.run, which the docs call “remote code execution on that Mac.” To disable remote execution, set security to deny and remove node pairing.

Be aware of the default you are leaving. The trust model documents that in the trusted single-operator default, host exec is “allowed without approval prompts (security="full", ask="off").” The baseline replaces that with deny and ask-always.

Step 7: Turn On Sandboxing

Sandboxing runs tool execution inside an isolated backend. It is off by default. The settings are in the sandbox modes reference:

Setting	Key	Values	Default
Mode	`agents.defaults.sandbox.mode`	`off`, `non-main`, `all`	`off`
Scope	`agents.defaults.sandbox.scope`	`agent`, `session`, `shared`	`agent`
Backend	`agents.defaults.sandbox.backend`	`docker`, `podman`, `ssh`, `openshell`, `crabbox`	`docker`

Pick the mode with care. non-main sandboxes every session except the agent’s main session, so your own main chat still runs on the host. all sandboxes every session. For an agent that reads untrusted content, all is the safer choice. The runbook’s minimal exposed baseline uses sandbox: { mode: "non-main" }, so decide deliberately.

Other sandbox rules from the docs:

Keep scope at agent or use session for stricter isolation. shared uses a single container.
Keep workspaceAccess at its default "none" where you can. "ro" mounts the workspace read-only.
Keep bind mounts narrow. Avoid credential folders, your home directory, the Docker socket, and system paths.
Check the result with openclaw sandbox explain and openclaw sandbox list.

Remember the limits, in the docs’ words: the gateway process “always stays on the host,” tool allow and deny rules apply before the sandbox, and a denied tool is not brought back by sandboxing. The project has also published advisories for sandbox bypasses, so sandboxing is one layer, not the whole defense.

Step 8: Treat Plugins and Skills as Code

Plugins run in-process with the gateway, and the docs say to “treat them as trusted code.” Skills are trusted code too: “Treat skill folders as trusted code and restrict who can modify them.”

Use an explicit allowlist. Prefer plugins.allow over loading whatever is installed.
Install only from sources you trust. ClawHub packages and the bundled official catalog count as trusted sources in the docs. A new npm, git, local, or marketplace source warns before install.
Pin exact versions (for example @scope/pkg@1.2.3) and inspect the unpacked code before enabling.
Set an install policy. security.installPolicy lets you run a trusted local command that returns allow, warn, or block for each skill or plugin install.
Scan with the audit. The docs point to openclaw security audit --deep for diagnostic scanning, because OpenClaw does not run built-in dangerous-code blocking during install or update.
Know the gap. OpenClaw’s own threat model admits “No runtime execution sandbox isolates a skill from the agent’s own privileges once installed.”

For browser control, use a dedicated profile for the agent and never your personal browser profile, since a logged-in profile gives the agent access to those accounts (browser control risks).

Step 9: Protect Secrets and Logs

OpenClaw stores configuration, credentials, and transcripts in ordinary files. The secrets and storage docs tell you to “assume anything under ~/.openclaw/ may contain secrets or private data.”

Tighten permissions: 700 on the state directory and 600 on files. The audit’s --fix option applies this, and on Windows it uses ACL resets instead.
Keep provider credentials out of workspace .env files. OpenClaw blocks them from untrusted workspace .env files, so put them in the gateway process environment, ~/.openclaw/.env, or the config env block instead.
Remember transcripts hold secrets. The docs say transcripts, tool arguments, tool results, and .env reads keep their original text, including credentials. Anyone with file access can read them.
Redact custom patterns: add logging.redactPatterns for internal URLs or other sensitive strings.
Share openclaw status --all instead of raw logs when you ask for help.
Prune old transcripts and logs you do not need.

Step 10: Run the Built-In Audit

The security audit is the fastest way to catch drift from safe settings. Run it after any config change and before exposing a network surface:

openclaw security audit
openclaw security audit --deep    # attempts a live Gateway check
openclaw security audit --fix     # apply safe remediations
openclaw security audit --json

--fix is deliberately narrow. According to the docs, it flips open group policies to allowlists and tightens state, config, and include-file permissions. Review the remaining findings yourself, because they cover settings --fix does not touch.

The audit checks inbound access, cross-agent session access, tool damage potential, command execution settings, network exposure, browser control, file permissions, plugins, and policy drift. Each finding carries a checkId such as gateway.bind_no_auth. The docs give a triage order:

Anything “open” with tools enabled: lock DMs and groups first, then tighten tool policy and sandboxing.
Public network exposure (LAN bind, Funnel, missing auth): fix immediately.
Remote browser control: treat it like operator access.
Permissions: state, config, and credentials must not be group- or world-readable.
Plugins: load only what you explicitly trust.

An audit with no findings is not proof of safety. It checks configuration, not whether a model was manipulated.

Step 11: Write the Incident Plan

Write this down before something goes wrong. The operator incident response page gives a four-part plan:

Contain. Stop the gateway process, set gateway.bind: "loopback" (or disable Tailscale Funnel or Serve), and switch risky DMs and groups to dmPolicy: "disabled", removing any "*" entries.
Rotate. Replace the gateway auth token or password, any remote client secrets, and every provider credential: chat tokens, model API keys, and others.
Audit. Read the logs with openclaw logs, review the transcripts in ~/.openclaw/agents/<agentId>/sessions/, check recent config changes that could have widened access, and re-run openclaw security audit --deep.
Collect for a report. Keep the timestamp, OS and OpenClaw version, redacted transcripts and logs, what was sent, and whether the gateway was exposed.

Also decide in advance how you would wipe and rebuild the host. Malwarebytes and ThaiCERT both advise preparing a full reset and credential rotation plan. If the agent ever touched customer data, check your breach-notification duties, which depend on where you operate.

Maintenance Routine

When	What to do
After every update	`openclaw doctor`, then `openclaw security audit --deep`. Re-check that the baseline settings are still in place.
After every config change	`openclaw security audit`. Confirm an authorized sender works and an unauthorized one is denied.
Weekly	`openclaw update status`. Skim the advisories page for new critical or high items.
Monthly	Review pairing lists and allowlists, installed plugins and skills, and pending config drift. Prune old transcripts.
Before adding any tool, channel, or person	Re-read Steps 5 to 7 and widen one control at a time.

Frequently Asked Questions

What does `openclaw security audit` do?

It inspects your configuration for drift from safe defaults, covering inbound access, tool permissions, network exposure, browser control, file permissions, and plugins, and reports findings with severities (running the audit). With --fix it applies a narrow set of safe remediations.

Is sandboxing enough to make OpenClaw safe?

No. The docs call it “not a perfect security boundary,” the gateway process stays on the host, and the project has published sandbox-bypass advisories. Use it together with tool restrictions, isolation, and updates.

Should I use sandbox mode `all` or `non-main`?

all sandboxes every session including your main one. non-main leaves the main session on the host. For an agent that reads untrusted content, all is the more cautious choice.

How often should I update OpenClaw?

Check at least weekly with openclaw update status, and re-run the audit after each update. The project ships releases frequently, and the latest at the time of writing was v2026.10.5.

Can I expose OpenClaw to the internet?

The docs say to avoid direct public port-forwarding and describe public internet exposure as rare and high-risk. If you need remote access, use a loopback gateway with an SSH tunnel or Tailscale Serve.

Does this checklist make it safe for customer data?

No. Hardening lowers risk but does not make an experimental agent appropriate for customer, payroll, banking, or other regulated data. See the pillar guide for what never to connect.

What if I think my install was compromised?

Follow Step 11: contain, rotate every credential, audit logs and transcripts, and re-run the deep audit. Wipe and rebuild the host if you cannot explain what happened.

Continue Learning

Start here:

Is OpenClaw Safe for Business? Real Risks and When Not to Use It

Safer automation:

Coming next in this series:

OpenClaw Setup for Beginners: Safe Steps and Real Running Costs

Hardening is a routine, not a one-time task. Apply the baseline, widen one control at a time, and run the audit every time something changes.