Keeping n8n secure
Your n8n instance holds a working key to every system it touches. It deserves to be treated that way.
Why this matters more than it looks
An n8n instance is a place where credentials collect. Automate your email, your CRM, your database and your payments, and it now holds a working key to all four. Get into the instance and you are into everything behind it.
This is the checklist we apply to every instance we run. If you run your own, take it.
Who can get in
- Never put n8n straight on the internet. A proxy with TLS in front, always. Keep the editor behind a VPN or an IP allowlist where you can.
- Single sign-on, or at minimum enforced strong login for every user. n8n Enterprise adds single sign-on and per-project roles (when Enterprise is worth it).
- Give people the least access that works. Someone building workflows does not need to own the instance; someone reading them does not need to edit.
Credentials and secrets
- Set a strong encryption key, and back it up somewhere other than the database. Your credentials are only as safe as that key.
- On Enterprise, keep secrets in an external store. Rotate tokens on a schedule, and whenever somebody leaves.
- Grant the narrowest access that does the job. An agent that reads one calendar does not need access to the whole domain.
What is exposed
- Webhook URLs are not secret. Add verification to every production webhook: a signature, a secret in the path, or a header token.
- Keep the editor and the webhooks on different hosts. The editor should be locked down; the webhook endpoint has to be reachable. n8n supports splitting them for exactly this reason.
- Limit what the instance can reach outbound where you can. An instance that can only talk to the services it automates limits how far a problem spreads.
Keeping it that way
- Update it. n8n fixes security issues in regular releases; an instance pinned to last year's version is a published list of ways in. (This is where having it operated quietly pays for itself.)
- Use Postgres in production, take encrypted backups, and actually practise restoring one. A backup you have never restored is a hope, not a backup.
- Send logs somewhere the instance cannot erase. Access and execution logs matter most exactly when the instance itself is compromised.
The two risks the AI layer adds
Data leaving. Every model call sends something to a provider. Decide which kinds of customer data may go to which provider, and route accordingly (using more than one provider).
Prompt injection. If an agent reads incoming email, someone can put instructions in an email. The defence is not clever wording, it is structural: keep anything irreversible, anything that spends money, and anything that sends data outwards behind a human approval step (more on this).
The honest summary
None of this is exotic. It is ordinary web hardening applied to an unusually valuable target, plus two new rules for the AI part. What it is not is a one-off weekend. It is recurring work, which is why security is a standing line in every instance we run (hosting options).
Running your own and want a second pair of eyes? We review existing n8n installations.
FAQ
Why is an n8n instance a high-value target?
Because it collects credentials. It holds working tokens for your email, your CRM, your database and your payment provider, all in one place. Someone who gets into it gets into everything you have connected. Public internet scans regularly turn up n8n installations with no login on them at all.
What is the single most important thing to get right?
Do not put n8n straight on the internet. Put a proxy with TLS in front of it, and keep the editor behind a VPN or an IP allowlist if you can.
How are credentials protected?
n8n encrypts them with an encryption key you set. Anyone with both the database and that key has your credentials, so the key must be strong and must be backed up somewhere separate from the database.
Are webhooks secure by default?
No. A webhook URL is just a URL. Add verification to every production webhook, a signature, a secret in the path, or a header token, and keep the public webhook endpoint on a different host from the editor.
What extra risks does the AI part add?
Two. First, data leaving: decide which customer data may go to which model provider and route accordingly. Second, prompt injection: an email can contain instructions aimed at your agent. Keep anything irreversible behind a human approval step.
Can you review an instance we already run?
Yes. We review existing n8n installations and give you the findings, whether or not you then want us to run it.