Self-Hosting n8n or Other Automation Tools: A Security Checklist

Why a self-hosted automation server is a high-value target

An automation server is a key ring. Each workflow needs credentials: your email account, Google Drive, Xero, Stripe, a CRM, an AI provider. n8n stores them in its database, encrypted. Anyone who takes over the server can often use or decrypt them, and then reach every connected system.

That risk was not theoretical in 2026. CSA published alerts on n8n vulnerabilities through the year:

CSA's February alert also suggested temporary mitigations if patching was delayed: limit workflow creation and editing to fully trusted users, and run n8n with restricted operating system privileges and network access.

Authentication in front of n8n

n8n's securing guide lists the built-in controls: user management, SSL, SSO, two-factor authentication, security audits, disabling the public API and blocking specific nodes.

Webhook and form URLs have to be reachable for workflows to run, so they are public by design. Treat every public workflow trigger as an entry point: validate input, and avoid passing form data straight into code or commands.

Updates: the part that decides whether self-hosting is safe

Self-hosting means you are the one who applies security releases. If an n8n update ships on a Tuesday, your server stays exposed until someone upgrades it.

1. 1

   Pin a version, but track it

   Use a specific n8n image tag rather than "latest", so updates are deliberate, and record which version is running.

2. 2

   Subscribe to security notices

   Watch n8n's release notes and CSA's alerts. Decide in advance who reads them and who upgrades.

3. 3

   Back up before every upgrade

   Database plus encryption key, so a failed upgrade can be rolled back.

4. 4

   Upgrade within days for security releases

   Test a couple of key workflows afterwards. Major version jumps need more testing; read the migration notes first.

5. 5

   Update the host too

   The operating system, Docker and the reverse proxy all need patching, not only n8n.

The encryption key and credentials

n8n's encryption key documentation explains that n8n creates a random key on first launch, saves it in the .n8n folder, and uses it to encrypt credentials before saving them to the database. You can set your own with the N8N_ENCRYPTION_KEY environment variable, and in queue mode every worker needs the same key.

• Back it up separately and securely. Without the key, a restored database cannot decrypt your credentials.
• Do not commit it to Git or paste it into shared documents. Keep it in a password manager or a secrets store.
• Rotate it when needed. n8n's securing guide includes a procedure for rotating encryption keys.
• Use least-privilege credentials. Give each workflow an API key with only the access it needs, not an admin account.

Network exposure: the CARBONATO lesson

Most self-hosted n8n runs in Docker. In September 2026, CSA's CARBONATO advisory described a botnet taking over servers whose Docker Remote API was open to the internet without authentication. Our CARBONATO guide explains how to check for it.

Docker's own guide to protecting the Docker daemon socket says Docker uses a non-networked Unix socket by default, and that remote access should be protected with SSH or TLS. For a small n8n server, the rules are simple:

Set these rules in your cloud provider's firewall, not only on the server, so a misconfigured container cannot open a port by accident.

Backups and when n8n Cloud is cheaper

Back up the database and the encryption key on a schedule, keep at least one copy off the server, and restore it to a test machine once so you know it works. Export important workflows as JSON as a second safety net.

Then compare costs honestly. n8n's pricing page lists cloud plans from EUR 20 a month (Starter, 2,500 workflow executions) and EUR 50 a month (Pro, 10,000 executions), both billed annually, as of October 2026. A small server costs less in cash, but someone has to watch alerts, upgrade, patch the host and test backups, every month.

If n8n feels like more than you need, our Zapier vs Make comparison covers fully managed alternatives.

Do it yourself or get help?

If you or someone on the team is comfortable running Linux servers, self-hosting n8n with the checklist above is reasonable. If not, the safest choice is a managed cloud plan, so security releases are applied for you.

If you would rather not run a server at all, our Workflow Automation (S$390 per workflow) builds workflows in your own Make, Zapier or Apps Script account with error alerts and documentation. Our Security Health Check (S$290) gives a written, risk-ranked review of your domain, website, email and Microsoft 365 or Google Workspace settings, a useful check if automation credentials may have been exposed.