Every service running on your server listens on a port — a numbered channel through which it receives connections. Your web server listens on 80 and 443. Your database on 3306. SSH on 22. Most servers have dozens of ports open, and not all of them should be reachable from the public internet.
Unnecessary open ports are one of the most common ways attackers get a foothold.
Why open ports are a risk
An open port is an entry point. If the service behind it has a known vulnerability, an attacker can exploit it directly. Even well-maintained services can be compromised by unpatched vulnerabilities, weak credentials, or misconfiguration.
Ports commonly left exposed by mistake
| Port | Service | Risk |
|---|---|---|
| 22 | SSH | Brute-force if password auth is enabled |
| 3306 | MySQL | Should never be internet-facing |
| 5432 | PostgreSQL | Same — database ports should be private |
| 27017 | MongoDB | Famously misconfigured; many breaches traced here |
| 6379 | Redis | Often runs without authentication by default |
| 8080 / 8443 | Admin panels, dev servers | Often forgotten after setup |
| 21 | FTP | Unencrypted; replace with SFTP |
What to do
Close every port that doesn't need to be publicly accessible. Databases, caches, and internal services should only be reachable within your private network. For SSH: disable password authentication and use key-based auth only.
threatprobe.app's free scan checks for exposed ports using public internet-scan data. The Basic report adds a live port scan directly on your host.