Does this checklist scan or secure my OpenClaw host?

No. It is a local planning aid based on OpenClaw documentation. It does not connect to your host, inspect configuration, remediate findings, or certify that a deployment is secure.

Does Terminalbox receive my checklist answers?

No. Checked items stay in browser memory and disappear on refresh. Analytics record only the page view and actions such as copy, download, opening the hosting guide, or opening plans.

Does a Terminalbox workspace complete these checks automatically?

No. Terminalbox supplies an isolated persistent Linux host, browser terminal, SSH access, and optional tailnet access. You still configure OpenClaw providers, channels, gateway authentication, tool policy, plugins, updates, audits, and backups.

Why keep the gateway on loopback?

Loopback is OpenClaw’s secure default for a local gateway. Reach the Control UI through a private SSH tunnel or tailnet route instead of exposing the gateway port directly to the public internet.

When should I run the security audit?

Run openclaw security audit --deep after meaningful configuration or exposure changes and review the findings against your threat model before relying on the gateway.

OpenClaw security checklist — free readiness review

12 checks · 4 boundaries

Verify what your gateway can reach and who can reach it.

Host

Keep one trusted operator boundary per gateway Use separate gateways or hosts when people should not share delegated tool authority.

Verify Document exactly who is trusted to operate or message this gateway. OpenClaw source ↗

Use a supported, dedicated host Plan for 1–2 vCPU, at least 2 GB RAM for typical use, 64-bit Linux, and a currently supported Node.js release.

Verify Run: node --version && uname -m OpenClaw source ↗

Keep state and workspace on persistent storage The host should retain OpenClaw state, credentials, configuration, and workspace data across restarts.

Verify Confirm the state and workspace paths survive a host restart. OpenClaw source ↗

Access

Harden administrative access first Secure the host login path before connecting credentials, channels, or externally reachable services.

Verify Review SSH keys, privileged accounts, firewall rules, and pending system updates. OpenClaw source ↗

Keep the gateway on loopback by default A loopback bind limits the gateway and Control UI to the host unless you deliberately add a private access path.

Verify Confirm the gateway listens on 127.0.0.1 rather than a public interface. OpenClaw source ↗

Use a private remote-access path Prefer an SSH tunnel or tailnet route when opening the Control UI from another device.

Verify Test the private route, then confirm the gateway port is not publicly reachable. OpenClaw source ↗

Require authentication for any non-loopback bind If you intentionally bind beyond loopback, configure gateway authentication and treat the endpoint as sensitive.

Verify Verify an unauthenticated request cannot reach the gateway or Control UI. OpenClaw source ↗

Authority

Restrict who can message the agent Use DM policies, pairing, and channel or sender allowlists so an unexpected participant cannot invoke the agent.

Verify Review every enabled channel and its allowed senders or groups. OpenClaw source ↗

Limit tools to the smallest useful authority Use tool policy, sandboxing, and approvals to reduce the impact of prompt injection or a mistaken action.

Verify Disable tools the workflow does not need and test the remaining approval boundaries. OpenClaw source ↗

Allowlist only reviewed plugins Plugins execute inside the gateway process, so install and enable only code you are prepared to trust.

Verify Inventory enabled plugins and remove anything unreviewed or unused. OpenClaw source ↗

Operations

Protect local state and sensitive logs Keep OpenClaw state readable only by the service account and retain sensitive-data redaction in logs.

Verify Review state-directory permissions and current logging redaction settings. OpenClaw source ↗

Audit and back up before relying on the host Run the deep security audit after configuration changes, review its findings, and keep recoverable copies of state and workspace data.

Verify Run: openclaw security audit --deep OpenClaw source ↗

OpenClaw security checklist

A review aid—not a security scan.