diff --git a/example-conf.yml b/example-conf.yml
index db06380..51049e1 100644
--- a/example-conf.yml
+++ b/example-conf.yml
@@ -283,6 +283,11 @@ servers:
         #autoperform:
         #   - "NOTICE somebody :hello, i've connected"
 
+        # Determines whether oper statuses should be tracked on this Clientbot network. This
+        # defaults to False for the best security, since oper status may allow more access to the
+        # entire PyLink service than what's desired, even when PyLink is only connected as a bot.
+        track_oper_statuses: false
+
 # Plugins to load (omit the .py extension)
 plugins:
     # Commands plugin: Provides core commands such as logging in, shutting down
diff --git a/protocols/clientbot.py b/protocols/clientbot.py
index 4ab92d1..4695b81 100644
--- a/protocols/clientbot.py
+++ b/protocols/clientbot.py
@@ -503,16 +503,17 @@ class ClientbotWrapperProtocol(Protocol):
         else:
             log.warning('(%s) handle_352: got wrong string %s for away status', self.irc.name, status[0])
 
-        if '*' in status:  # Track IRCop status
-            if not self.irc.isOper(uid, allowAuthed=False):
-                # Don't send duplicate oper ups if the target is already oper.
-                self.irc.applyModes(uid, [('+o', None)])
-                self.irc.callHooks([uid, 'MODE', {'target': uid, 'modes': {('+o', None)}}])
-                self.irc.callHooks([uid, 'CLIENT_OPERED', {'text': 'IRC Operator'}])
-        elif self.irc.isOper(uid, allowAuthed=False) and not self.irc.isInternalClient(uid):
-            # Track deopers
-            self.irc.applyModes(uid, [('-o', None)])
-            self.irc.callHooks([uid, 'MODE', {'target': uid, 'modes': {('-o', None)}}])
+        if self.irc.serverdata.get('track_oper_statuses'):
+            if '*' in status:  # Track IRCop status
+                if not self.irc.isOper(uid, allowAuthed=False):
+                    # Don't send duplicate oper ups if the target is already oper.
+                    self.irc.applyModes(uid, [('+o', None)])
+                    self.irc.callHooks([uid, 'MODE', {'target': uid, 'modes': {('+o', None)}}])
+                    self.irc.callHooks([uid, 'CLIENT_OPERED', {'text': 'IRC Operator'}])
+            elif self.irc.isOper(uid, allowAuthed=False) and not self.irc.isInternalClient(uid):
+                # Track deopers
+                self.irc.applyModes(uid, [('-o', None)])
+                self.irc.callHooks([uid, 'MODE', {'target': uid, 'modes': {('-o', None)}}])
 
         self.who_received.add(uid)