EA Security: Protecting Your Strategy Code and Account

EA security is the part of automation that most traders discover only after something goes wrong. An expert advisor is both a trading system and a piece of software, and the second half of that identity is easy to forget: compiled strategy code can be decompiled, malicious EAs can phone home with your API keys, and a broker account is only as safe as the credentials and infrastructure around it. This post covers why EA code gets stolen, DLL and WebRequest risks, licensing and obfuscation, hardening the VPS that runs your systems, and the account-level habits that keep automated trading safe. For the surrounding setup, see the VPS trading guide and the broker for EA trading guide.

EA security: why strategy code gets stolen

MetaTrader’s compiled files are not encrypted. An .ex4 or .ex5 file is a compressed package that free decompiler tools can reconstruct into readable MQL4 or MQL5 source. Anyone who receives a copy of your file — a broker, a client, a forum download, a shared cloud folder — can recover the logic, strip your branding and resell it, or simply trade it themselves. Strategies that took months of testing are routinely replicated in minutes because the author assumed the compiled file was a closed box.

The defensive implications follow directly. Never distribute an EA you are not prepared to have copied; treat every copy as a copy of your source. Keep your working source code off machines that run third-party EAs, and never upload full strategy code to brokers or testing services. If a strategy is genuinely valuable, treat the code like a private key: shared with no one and moved only in encrypted archives. The FCA’s scam warnings show how quickly trading software circulates through unregulated channels, where decompiled strategies resurface.

EA security: DLL and WebRequest risks

Two EA features deserve specific distrust. A DLL call executes native code with the privileges of the MetaTrader process, so a malicious or compromised DLL can read files, capture keystrokes, access API keys and communicate with the internet without the platform’s permission prompts.

WebRequest is the quieter cousin of the same problem. An EA with WebRequest enabled can send data to any domain on the broker’s approved list, which is precisely how a malicious EA sends account numbers, balances and live positions to a remote server. Never run an EA with WebRequest enabled unless you have read the code and know what it sends, and never put API keys or account credentials into files it can read. When testing an EA you do not fully trust, use a demo account on a machine with no other financial data on it.

EA security: licensing and obfuscation for strategy logic

For strategy protection the platform’s built-in licensing is the first layer. Both MT4 and MT5 let an EA check the account number and refuse to run elsewhere, which does not stop the code being read but stops it being used profitably by whoever stole it. Licensing also matters commercially: account-locked builds mean each customer’s copy is traceable, reducing the incentive to redistribute it.

Obfuscation is the second layer. Renaming variables and functions, splitting logic across libraries and adding environment checks make reverse engineering slower, though not impossible. It raises the cost of theft from minutes to hours or days and deters casual copying rather than determined attackers. For strategies that are genuinely commercial, treat the compiled file as the product and the source as a trade secret. The European Securities and Markets Authority publishes consumer guidance on technology-based trading products and acceptable industry practice.

EA security: hardening your VPS

The VPS that runs your EA is a bigger attack surface than the EA itself: a server on the internet with a password. Default and reused passwords are the most common way accounts are compromised, followed by exposed remote desktop ports and unpatched operating systems. Hardening starts with a strong unique password, continues with a firewall restricting remote access to your IP address, and includes updating the operating system and MetaTrader installations.

Two-factor authentication matters here as much as on a bank account. Every service connected to the trading stack — the VPS provider, the broker portal, the password-reset email — should have 2FA enabled; a password reset email is a common backdoor into a trading account. Run MetaTrader under a limited user account rather than an administrator account, and never browse the web on the VPS that runs your live EAs. The VPS trading guide walks through choosing and securing a provider.

EA security: broker account and API key hygiene

The broker account itself is the final layer. Use a separate account for automation than for manual trading where practical, so a compromised EA exposes only part of your capital. Enable every security feature the broker offers, including login notification and withdrawal whitelists, and keep the login password away from the EA files. The broker for EA trading guide covers how to evaluate a broker’s regulatory standing, and a regulated broker subject to ESMA or FCA rules is part of account safety as well as execution quality.

API key hygiene is the fastest-growing risk in automated trading. Keys for exchange APIs, VPS providers and data feeds are stored in EA inputs, config files and email threads, and every such copy is an exposure. Never put an API key in an EA you did not write, and rotate keys after any contact with an untrusted machine. A key with withdrawal permission is effectively a password, and it deserves password-grade storage in a dedicated manager rather than a comment in a trading script.

Frequently asked questions about EA security

Can my expert advisor code be stolen?

Yes. MT4 and MT5 compiled files are not encrypted, and free decompilers exist that reconstruct readable source code from them. Anyone who receives a copy of an .ex4 or .ex5 file can recover the strategy logic, so code protection has to be treated as a genuine concern rather than an unlikely scenario.

Are DLL calls and WebRequest functions dangerous in an EA?

They are the two highest-risk features an EA can use. A DLL runs with the privileges of the platform, so a malicious or compromised DLL can read files, capture keystrokes and access API keys on the machine. WebRequest functions exfiltrate data to remote servers, which is how a stolen or malicious EA phones home.

How do I protect my strategy logic before sharing an EA?

Use the platform’s licensing features so the file only runs on accounts you authorise, add input validation and self-checks to make reverse engineering harder, and consider obfuscation if the strategy is valuable enough to justify it. Keep your working source files off machines that also run third-party EAs.

What is the most important EA security measure for a live account?

Isolate the account. Use a dedicated, hardened VPS with a strong unique password and firewall, enable two-factor authentication on everything connected to the account, keep API keys out of EAs and config files, and run only EAs whose source you trust. One compromised credential can empty an account faster than any market move.

Explore Secure Automation Tools

Risk disclosure: Trading foreign exchange, commodities, CFDs and indices carries a high level of risk and may not be suitable for all investors. Expert advisors are software products and carry technical risks in addition to market risk, and no security measure can guarantee that code will not be copied or that credentials will not be compromised. Past performance is not indicative of future results. AlgoTM provides trading tools and technology only and does not provide investment advice, portfolio management or guaranteed returns.