Best OpenClaw Security Settings — Hardened Configuration 2026

Security in OpenClaw is about limiting blast radius — if something goes wrong, how much damage can it do? Here are the best security configurations for different risk profiles.

Baseline Security (Everyone Should Have This)

# ~/.openclaw/openclaw.json:
{
  "security": {
    "exec": {
      "mode": "allowlist",
      "allowedCommands": [
        "curl", "wget",
        "python3", "node", "npm",
        "git", "ls", "cat", "grep", "find",
        "jq", "date", "echo"
      ],
      "ask": "on-miss"
    }
  }
}

# ~/.openclaw/.env — permissions:
chmod 600 ~/.openclaw/.env
chmod 700 ~/.openclaw/

VPS Production Security

# Stricter allowlist for production:
{
  "security": {
    "exec": {
      "mode": "allowlist",
      "allowedCommands": ["curl", "python3", "jq", "date", "echo"],
      "ask": "off",
      "elevated": { "mode": "deny" }
    },
    "network": {
      "allowedDomains": [
        "api.anthropic.com",
        "api.slack.com",
        "api.telegram.org",
        "api.stripe.com",
        "hooks.slack.com"
      ]
    },
    "workspace": {
      "readOnly": false,
      "allowedPaths": ["~/.openclaw/workspace/", "~/data/"]
    }
  }
}

Privacy-First Configuration (Local LLM)

# For maximum data privacy:
openclaw config set llm.provider ollama
openclaw config set llm.model llama3.2
openclaw config set llm.baseUrl http://localhost:11434

# Disable telemetry:
{
  "telemetry": {
    "enabled": false
  }
}

# Strip PII from workspace files that would go to cloud:
# Remove USER.md contents or replace with minimal context

Team/Multi-User Security

# Separate workspaces per user:
openclaw init --workspace /home/alice/.openclaw/workspace
openclaw init --workspace /home/bob/.openclaw/workspace

# Each user runs their own gateway on a different port:
# Alice: openclaw config set api.port 3001
# Bob: openclaw config set api.port 3002

# File permissions:
chmod 700 /home/alice/.openclaw/
chmod 700 /home/bob/.openclaw/

API Key Rotation Policy

openclaw cron add \
  --name "hex-security-audit" \
  --schedule "0 9 * * 1" \
  --agent main \
  --task "Security audit check: verify ~/.openclaw/.env permissions are 600. Check if any API keys are approaching 90 days old (check creation dates in provider dashboards). List connected channels and verify all are expected. Report any anomalies to Slack. If an API key is 90+ days old, remind me to rotate it."

Audit Logging Setup

# Enable detailed audit logging:
{
  "logging": {
    "level": "info",
    "logExecCommands": true,
    "logNetworkRequests": true,
    "auditLog": "~/.openclaw/audit.log"
  }
}

# Review audit log weekly:
tail -100 ~/.openclaw/audit.log | grep -E "exec|network|auth"

Firewall Configuration (VPS)

# UFW setup for OpenClaw VPS:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 3000/tcp  # OpenClaw API (restrict to your IPs)
sudo ufw enable

# Restrict API port to specific IP only:
sudo ufw allow from YOUR.OFFICE.IP.ADDRESS to any port 3000

Get the complete setup guide in The OpenClaw Playbook — everything you need to master OpenClaw for $9.99.