Port Scanner
Check which ports are open on any domain or IP. Scan 21 common TCP ports including HTTP, SSH, database, and mail ports.
Only scan systems you own or have permission to test.
Port Security Essentials
Understanding Ports, Firewalls, and Exposure
A TCP port is simply an address on a host where a service can listen — one machine, thousands of possible doors. When a scanner probes a port, three outcomes are possible: open means a service completed the TCP handshake and is accepting connections; closed means the host answered with a reset, so nothing is listening but the host itself is reachable; filtered means no answer came back at all, which almost always indicates a firewall silently dropping the probe. Reading a scan is therefore less about the individual ports and more about the overall picture: what did you intend to expose, and does the scan match that intent?
The findings that matter most are database and admin services listening on public interfaces. Redis, MongoDB, MySQL, PostgreSQL, and RDP were all designed to sit on trusted internal networks, and several of them historically shipped with no authentication enabled by default. Publicly exposed Redis and MongoDB instances have been mass-compromised in repeated waves — data wiped, held for ransom, or quietly exfiltrated — precisely because internet-wide scanning makes every exposed instance discoverable within hours. An open database port on a public IP is rarely a deliberate choice; it is usually a security group edited in a hurry and never reviewed.
The durable fix is a default-deny posture: block everything inbound, then explicitly allow only what the service genuinely needs — typically 80 and 443 for a web host, and little else. Administrative access (SSH, RDP, database consoles) belongs behind a VPN or a bastion host rather than on the open internet, even with strong credentials. And a note on ethics that doubles as law: only scan hosts you own or are explicitly authorized to test. Unauthorized scanning violates computer misuse legislation in most jurisdictions and most providers' acceptable-use policies, regardless of intent.
Frequently Asked Questions
What is a port scanner?
A port scanner tests network ports on a host to determine which are open (accepting connections), closed (actively rejecting), or filtered. Each port corresponds to a specific service: 80 (HTTP), 443 (HTTPS), 22 (SSH), etc.
Is it legal to scan ports?
Scanning ports on your own servers or with explicit written permission is legal. Scanning systems without permission is illegal in most jurisdictions. This tool is designed for checking your own infrastructure.
What does an open port mean?
An open port means a service is actively listening and accepting connections. Unnecessary open ports should be closed to reduce attack surface — especially database ports like 3306, 5432, or 27017.
How do I close an open port?
Stop the service or configure your firewall/security group to block access. On Linux: use ufw or iptables. On AWS: configure Security Groups. On GCP: configure Firewall Rules.
Why does a port show as 'filtered' instead of open or closed?
Filtered means the scanner received no response at all: a closed port actively replies with a TCP reset, but a firewall configured to silently drop packets produces silence instead. This is normal and usually desirable — cloud security groups and most host firewalls drop unsolicited traffic by default. From an attacker's perspective, a filtered port reveals that a firewall exists but nothing about the service behind it.
Should SSH (port 22) be open to the whole internet?
Ideally no — restrict it to your office and VPN IP ranges, or place it behind a bastion host, because any SSH port open to the world receives constant automated login attempts. If it must stay open, disable password authentication in favour of keys, disable direct root login, and use rate-limiting tools such as fail2ban. Moving SSH to a nonstandard port reduces log noise but is not a security control on its own.
How do attackers find open ports in the first place?
The entire IPv4 address space is scanned continuously by both researchers and attackers, and search engines such as Shodan and Censys index the services they find, so exposed hosts are discoverable with a simple query. A newly exposed service is typically found within hours, not weeks, regardless of whether anything links to it. The practical takeaway: obscurity offers no protection, so anything listening on a public port should be treated as actively probed.
Do I need permission to scan a server I manage but don't own?
Yes — legal authorization comes from the system owner, not from the fact that you administer it, so get the scope agreed in writing before scanning client or employer infrastructure. Many cloud providers also publish their own policies on security testing of resources hosted with them. This tool only checks a small set of common ports on hosts you enter, but the same rule applies: scan only what you own or are explicitly authorized to test.
Keep Your Attack Surface Under Control
CertNotify continuously monitors your domains and certificates — pair regular port scans with automated monitoring to catch newly exposed services before attackers find them.