How do I secure AnythingLLM?

Enable multi-user mode with a password: Settings → Security → enable Multi-User Mode and set an admin password. Single-user mode has no auth by design.

← what I check

EXPOSURE AnythingLLM
SEVERITY CRITICAL
PROBE GET :3001/api/ping

CRITICAL

Is your AnythingLLM exposed?

Q: How many AnythingLLM instances are exposed?

The population estimate for AnythingLLM is still collecting on the census.

Single-user mode has no login at all. Anyone can use your models and read your documents.

Scan a host you own → Fix card

Why it matters

Your AnythingLLM answers anyone on the internet with no login at all. Strangers can chat with your models (you pay for the tokens or the GPU), read every document you uploaded for RAG, and change your settings.

How common is it?

A published population estimate for AnythingLLM is still collecting. See the census methodology.

Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.

Fix it

The full walkthrough lives on the fix card, kept current in one place:

Full fix card: anythingllm-exposed →