Open ports: what an outsider can reach, and why that list matters

Every open port is a service accepting input from strangers. Most servers have more of them open than anyone intended, usually because something was installed once, bound to every interface by default, and never revisited.

What "open" means here

Three answers are possible when a connection is attempted, and the difference matters.

• Open — the handshake completed. Something is listening and will read what you send.
• Refused — a reset came back. The host is reachable and nothing is on that port. Informative, and not a risk.
• Filtered — nothing came back. A firewall dropped it, and the silence is deliberate.

A refusal proves the host is up. That is why some scans are useful even when nothing is open.

The ports worth explaining

80 and 443 are the job. Anything else facing the internet should have a reason:

• 22 — SSH. Fine if key-only and rate-limited; a password-accepting SSH port is guessed at continuously.
• 3306, 5432, 27017, 6379 — MySQL, PostgreSQL, MongoDB, Redis. A database on the public internet is almost never deliberate, and Redis historically had no authentication at all.
• 3389 — RDP. One of the most attacked ports there is, and the usual first step in a ransomware incident.
• 9200 — Elasticsearch. The source of a long list of "unsecured database exposes N million records" stories.

How to validate

nc -zv example.com 22
ss -lntp        # on the host: what is listening, and on which address

Run the second one. Scanning from outside tells you what is reachable today; ss -lntp tells you what is listening and on what interface, which is where the fix is. A service bound to 0.0.0.0 that only needs to serve localhost is one firewall change away from being exposed — and one mistake away from being exposed again.

Scan the name that resolves publicly, not the machine you are on. A cloud security group can leave a port closed to the internet while it is wide open inside the VPC, and only one of those is what a scan from outside shows.

How it helps your infrastructure

The list of open ports is the list of things that can be attacked at all. Closing one removes every future vulnerability in that service from your problem, permanently, without patching anything. Nothing else in security has that property.

It is also the check that most often surprises people. Databases, admin panels and management interfaces reachable from the internet are found routinely on hosts whose owners are certain they are not.

The Website Scanner reports which ports answered and which service each is, alongside the DNS and certificate facts for the same host.