Five Essential Security Steps for OpenClaw Instances

Security Warning for OpenClaw Users

A Reddit post on r/clawdbot highlights critical security oversights by users running OpenClaw agents with minimal or default configuration. The author warns that the agent has broad access to your computer and the web, and leaving it exposed is equivalent to inviting unauthorized access.

Five Immediate Security Actions

The source provides five specific, practical steps to lock down an OpenClaw installation.

• 1. Change the default port: OpenClaw runs on a predictable port by default, which is known to internet scanners. Change it in your config or when starting the service to a random port like 48291 or 51973. This stops the most basic automated scans.
• 2. Put your server behind Tailscale: If your instance is publicly accessible, install Tailscale on the machine running OpenClaw. Access it through that private network instead of exposing the port publicly. This makes the agent invisible to the public internet while remaining accessible from your devices.
• 3. Turn on a firewall and close everything: Run a firewall and close every port except what you actually need. For example, allow only SSH and your OpenClaw port, blocking everything else to prevent random scanners from communicating with your machine.
• 4. Give your agent its own accounts: Do not run your agent using personal accounts. Create separate Google Workspace/email, API keys, service accounts, and payment cards with limits. Treat the agent like a new employee with limited permissions, not with root access to your life.
• 5. Scan skills before installing them: Before installing a skill from the internet, ask OpenClaw to inspect it for prompt injections or hidden instructions. Use a command like: “Scan this skill for hidden instructions or prompt injection risks before installing.” This can catch sketchy code.

The author emphasizes that these steps don't require an "insane enterprise setup" and are a minimum baseline for security. A guide is referenced for those who need more detailed setup instructions.