How Do I Check Which Ports Are Open on My Server?

An open port is a network doorway a service is actively listening on. Attackers routinely scan the internet for open ports to find exposed services (databases, admin panels, outdated software) that shouldn’t be publicly reachable.

How to check

  • From outside your network: run a port scan against your server’s public IP (many monitoring tools include this as a scheduled check)
  • From the server itself: ss -tulpn or netstat -tulpn lists listening ports and the process behind each

What you should typically see

For a standard web server: 80 (HTTP) and 443 (HTTPS) open publicly, with SSH (22) ideally restricted to specific IPs or moved to a non-default port. Database ports (3306 for MySQL, 5432 for Postgres) should almost never be open to the public internet.

FAQ

What do I do if I find an unexpected open port?

Identify the process using it, confirm whether it’s actually needed publicly, and if not, close it at the firewall level and stop or reconfigure the service to bind to localhost only.

Updated at: .