Blog / Security
Ports explained: what “open” really means
When a security scan says “port 443 is open”, it sounds alarming, but it is usually normal. Here is what ports are and how to tell a harmless open port from a risky one.
What is a port?
An IP address identifies a device on a network. A port identifies a specific service on that device. Think of the IP address as a building and the port number as the door to one particular office. Ports are numbered from 0 to 65535, and each connection uses one.
What “open” means
- Open: a program is listening on that port and accepts connections.
- Closed: the device is reachable, but nothing is listening, so connections are refused.
- Filtered: a firewall is blocking or ignoring traffic, so you cannot tell what is behind it.
An open port simply means a service is running. Every website you visit has at least one open port.
Common ports
| Port | Service | Used for |
|---|---|---|
| 22 | SSH | Secure remote command line |
| 53 | DNS | Turning names into IP addresses |
| 80 | HTTP | Unencrypted web traffic |
| 443 | HTTPS | Encrypted web traffic |
| 3389 | RDP | Windows remote desktop |
When an open port is a risk
The question is not whether a port is open, but what is behind it and who can reach it. An open port is more likely to be a problem when:
- It is reachable from the whole internet, not just your local network.
- The service behind it is outdated or has a weak or default password.
- It is a service that should never face the internet, such as remote desktop (3389), file sharing (445), Telnet (23) or a database (3306, 5432, 27017).
- You do not remember opening it.
How to see what is open on your own computer
On Windows, open a command prompt as administrator and run netstat -ano. Lines marked LISTENING show open ports and the process ID using them. On Linux, run ss -tuln.
How to check your router
Log in to your router and open the Port forwarding or Virtual server page. Each rule there exposes a device to the internet. Remove any rule you do not recognise or no longer need.
Reduce your risk
- Close or disable services you do not use.
- Keep software and router firmware updated.
- Use strong, unique passwords, and a VPN instead of exposing remote desktop.
- Keep the firewall on.
Only scan networks and devices that you own or have permission to test.