Open Port Checker
Check open ports on any domain or IP address. Scan common services like HTTP, HTTPS, SSH, SMTP, FTP, MySQL, and more from the public internet.
What Is an Open Port?
An open port is a network port that accepts incoming connections because a service is listening on it. Web servers, mail servers, remote access tools, and databases all rely on specific ports to communicate.
Open
A service accepted the connection. The port is reachable from outside and is actively listening.
Closed
The system responded, but no service is listening on that port.
Timeout
No reply was received. This often suggests a firewall or packet filter is dropping the traffic silently.
Why Open Ports Matter for Security
Every reachable service increases your public attack surface. Not every open port is a problem, but each exposed service should be expected, patched, monitored, and properly restricted.
Exposure and Risk
Attackers routinely scan the public internet for exposed services such as SSH, RDP, databases, mail infrastructure, and web interfaces. If a service is outdated, weakly configured, or unnecessarily exposed, it may become a target.
Useful for Audits
External port checks are useful after firewall changes, server migrations, DNS cutovers, cloud deployments, or routine security reviews to confirm which services are reachable from outside.
Which Open Ports Are Normal?
Not every open port is a vulnerability. The real question is whether the exposed service is expected, necessary, and properly protected.
Usually Normal
Ports like 80 and 443 are normal for public websites. SMTP-related ports may also be expected for internet-facing mail infrastructure.
Depends on Context
SSH on port 22 may be expected for administration, but it is usually safer when limited to trusted IPs, VPN access, or jump hosts.
Often Higher Risk
Publicly exposed database ports, remote desktop services, and legacy file transfer services often deserve closer review and stronger access controls.
Common Ports We Check
Understand the services most commonly associated with these ports.
HTTP / HTTPS
80, 443These are the standard ports for public websites. Port 80 is HTTP and port 443 is HTTPS. They are often expected to be open on web servers.
FTP
21FTP is used for file transfer. It is older and often replaced by more secure alternatives such as SFTP or SCP.
SSH
22SSH is used for secure remote administration of Linux and Unix systems. If exposed publicly, it should usually be tightly restricted.
SMTP
25SMTP is used for mail transfer. It may be expected on dedicated mail systems, but should be reviewed if it appears on systems not intended for mail handling.
MySQL
3306MySQL database services are commonly safer when restricted to internal networks, VPNs, or trusted IP ranges instead of broad public exposure.
RDP
3389RDP is used for remote access to Windows systems. Publicly exposed RDP deserves special care because it is a common target in real-world attacks.
High-Risk Open Ports to Review
Some open ports deserve extra review because they are commonly associated with administration, remote access, or direct service exposure.
FTP
Legacy file transfer exposure can be risky if not secured properly.
SSH
Remote administration should usually be limited to trusted IPs or VPN access.
MySQL
Public database access often deserves tighter network restrictions.
RDP
Remote Desktop is commonly reviewed closely because of its administrative exposure.
Open Ports and Canadian Security Compliance
Unnecessary public exposure is one of the simplest ways systems become easier to target. For Canadian organizations, reducing that exposure supports good security hygiene and aligns with the broader expectation to use appropriate technical safeguards.
PIPEDA does not prescribe a fixed list of approved or prohibited ports, but it does require organizations to use safeguards appropriate to the sensitivity of the information they handle. Reviewing unnecessary open ports, remote access services, and exposed databases is part of that broader security mindset.
Publicly reachable admin interfaces, remote access tools, and database ports should generally be exposed only when there is a specific operational need and layered protections are in place.
How to Close Unused Ports
If a port is open and you do not expect it to be reachable, review the service and the network controls protecting it.
Review Firewall Rules
Check host firewalls, cloud security groups, and network ACLs to confirm only the ports you intend to expose are allowed.
Disable Unused Services
If a service is no longer needed, stop it and disable it so it does not reopen a port after a restart or deployment.
Restrict Admin Access
Remote administration services are often safer when limited to trusted IPs, VPN access, bastion hosts, or private network paths.
Check NAT and Forwarding
Router port forwarding rules, cloud load balancers, and old migration settings can accidentally leave services reachable from the internet.
Frequently Asked Questions
What is an open port?
An open port is a network port that accepts incoming connections because a service is actively listening on it.
Is an open port always a security risk?
No. Some open ports are necessary for websites, email, and remote services. The real question is whether the service is expected, secure, updated, and properly restricted.
What ports does this checker scan?
This open port checker scans a set of common ports associated with web, mail, remote access, and database services.
Can I scan a domain name instead of an IP address?
Yes. You can scan either a domain or a public IP address to see whether the selected common ports are reachable from the internet.
What does a timeout mean in a port scan?
A timeout usually means the target did not reply at all. This often suggests a firewall or filtering rule is silently dropping the traffic.
What does a closed port mean?
A closed port means the host is reachable, but no service is listening on that specific port.
Should MySQL port 3306 be public?
Usually not. Database services are often safer when restricted to internal networks, VPN access, or trusted IP ranges instead of broad public exposure.
Why scan ports from an external tool?
An external port check helps show what a public visitor or attacker may be able to reach from outside your network, which can differ from what you see internally.