How to Check if Your Domain Has Open Ports (And Why It Matters)

What is an open port?

Every server connected to the internet communicates through numbered ports. Think of them like doors on a building — each one is a potential entry point for a specific type of traffic. Port 443 is HTTPS web traffic. Port 25 is email. Port 22 is SSH remote access.

When a port is "open", it means a service is actively listening for connections on that port. That is normal and necessary — your website needs port 443 open to serve pages to visitors. The problem comes when ports are open that should not be, or when the services behind them are not properly secured.

An attacker scanning your domain will check all 65,535 possible ports. Anything that responds is a potential target. If you do not know what your domain is exposing, you are flying blind.

Why open ports matter for small businesses

Most small business owners think about security in terms of passwords and antivirus software. External port exposure rarely comes up — but it should.

Common problems we see on UK small business domains:

• Admin panels on non-standard ports — a WordPress admin interface running on port 8080, exposed to the entire internet
• Database ports left open — MySQL on port 3306 or MongoDB on 27017, directly accessible without a firewall
• Old remote desktop services — RDP on port 3389, a favourite target for ransomware operators
• FTP servers — often set up years ago and forgotten, sometimes still running with default or weak credentials
• Development servers — staging environments left running and accessible after a project ended

None of these are exotic. They are the kind of thing that accumulates over time when a business grows and nobody is keeping track of what is running where.

Ports that should almost always be closed

• Port 21 — FTP: Credentials sent in plaintext, frequent brute force target
• Port 23 — Telnet: Unencrypted remote access — never appropriate in 2026
• Port 3306 — MySQL: Direct database access — should never be internet-facing
• Port 3389 — RDP: Remote Desktop — major ransomware entry point
• Port 5432 — PostgreSQL: Same as MySQL — database should not be exposed
• Port 8080 / 8443 — Alternative HTTP/S: Often admin panels or dev servers left running
• Port 27017 — MongoDB: Frequently found with no authentication enabled

Ports that are normal to have open

For context, these ports being open on your domain is expected and fine:

• 80 — HTTP (redirects to HTTPS)
• 443 — HTTPS (your website)
• 25 / 465 / 587 — Email sending (if you run a mail server)

If you only run a standard website with no mail server, ports 80 and 443 are the only ones that should respond. Anything else warrants a closer look.

How to check your open ports

Option 1 — Run a free scan with Olimpio

Scan your domain with Olimpio and you will get a full port scan as part of the results — covering the top 1,000 most common ports, with findings explained in plain English. Critical and high-severity open ports are flagged automatically, with context on what each one means and how to close it. No technical knowledge required, results in around 15–20 minutes.

Option 2 — Use nmap yourself

If you are comfortable with the command line, nmap is the industry-standard port scanner. Install it on Mac (brew install nmap) or Linux (apt install nmap) and run:

nmap -sV yourdomain.com

The -sV flag attempts to identify what service is running on each open port. For a more thorough scan:

nmap -sV -p 1-65535 yourdomain.com

Note that scanning a domain you do not own without permission is illegal in the UK under the Computer Misuse Act. Only scan your own infrastructure.

Option 3 — Online tools

Services like Shodan (shodan.io) continuously scan the internet and index what they find. Searching for your domain or IP address will show you what is publicly visible — including open ports, service banners, and known vulnerabilities associated with those services.

What to do when you find an unexpected open port

If you find a port open that should not be, the steps are:

1. Identify what is running on it. Use nmap -sV or check your server's running services. On Linux: ss -tlnp shows what is listening and on which port.
2. Decide whether the service is needed. If it is a forgotten staging server or old FTP setup, shut it down entirely.
3. If the service is needed, firewall it. Block the port at your firewall or security group level so it is only accessible from specific IP addresses — not the whole internet.
4. Update and harden the service. If it must remain accessible, make sure it is running the latest version, has strong authentication, and is configured securely.

Port scanning and Cyber Essentials

Cyber Essentials Control 1 (Firewalls) specifically requires that unnecessary ports and services are not exposed to the internet. A port scan is one of the first things an assessor will run against your infrastructure. Knowing what your domain exposes before the assessment does is the right way to prepare.

If you are working towards Cyber Essentials certification, a free Olimpio scan will show you exactly which open ports would fail the assessment — giving you time to fix them before it counts.