An open port is a network doorway a service is actively listening on. Attackers routinely scan the internet for open ports to find exposed services (databases, admin panels, outdated software) that shouldn’t be publicly reachable.
How to check
- From outside your network: run a port scan against your server’s public IP (many monitoring tools include this as a scheduled check)
- From the server itself:
ss -tulpnornetstat -tulpnlists listening ports and the process behind each
What you should typically see
For a standard web server: 80 (HTTP) and 443 (HTTPS) open publicly, with SSH (22) ideally restricted to specific IPs or moved to a non-default port. Database ports (3306 for MySQL, 5432 for Postgres) should almost never be open to the public internet.
FAQ
What do I do if I find an unexpected open port?
Identify the process using it, confirm whether it’s actually needed publicly, and if not, close it at the firewall level and stop or reconfigure the service to bind to localhost only.