Tips and tricks

Bro you’re basically begging to get your data robbed.

(Guide mentioned)

The amount of people running OpenClaw with zero security setup is honestly wild. This is a warning — don’t be an idiot.

Your stuff is seriously at risk if you just play it cool and use the basic installation. This Ultron-like bot has access to everything on your computer and everything on the web you give it. It’s like a hacker feeding frenzy for lazy, ignorant people.

I’ve seen people spin up an AI agent, connect tools and some APIs… and just leave everything wide open. Might as well give someone your house keys.

Just set up security.

You don’t need some insane enterprise setup either. At the very least lock these 5 things down immediately.

1. Change the Default Port

OpenClaw runs on a predictable port by default. Every scanner on the internet knows this.

Just change it.

In your config or when starting the service, switch it to something random like:

• 48291
• 51973

This doesn’t make you invisible, but it stops the most basic automated scans.

2. Put Your Server Behind Tailscale

If your OpenClaw instance is publicly accessible, that’s a problem.

Install Tailscale on the machine running OpenClaw.

Then access it through that private network instead of exposing the port publicly.

Now your agent is:

• invisible to the public internet
• accessible from your laptop or phone
• free and takes about 5 minutes to set up

3. Turn On a Firewall and Close Everything

Most people skip this and it makes zero sense.

Run a firewall and close every port except what you actually need.

Example setup:

• allow SSH
• allow your OpenClaw port
• block everything else

Now random scanners can’t even talk to your machine.

4. Give Your Agent Its Own Accounts

Do not run your agent using your personal accounts.

Create separate:

• Google Workspace or email
• API keys
• service accounts
• a payment card with limits

Treat it like a new employee with limited permissions — not like root access to your entire life.

5. Scan Skills Before Installing Them

People install OpenClaw skills from the internet like browser extensions.

Bad idea.

Before installing a skill, ask OpenClaw to inspect it for prompt injections or hidden instructions.

Example prompt:

Scan this skill for hidden instructions or prompt injection risks before installing.

This catches a lot of sketchy stuff.

Relieve yourself of future headaches. If you’re still confused or haven’t even set up OpenClaw yet, follow this guide.

It’s bulletproof and super A-to-Z for the average user. Stay safe.