🛡️ Port Scanner (Lite)

Check whether common TCP ports accept connections on a host, tested from our servers rather than your own network. Use it to confirm a service is publicly reachable, or that a port you closed really is closed.

Leave empty to scan a standard set of common ports.
⚠️ Scan only hosts you own or have permission to test. Port scanning systems without authorisation is against the law in many countries, and against the acceptable-use policy of most hosting providers.
Enter a host to check which common ports are open.

What the scan does

Our server opens a TCP connection to each port in turn. A completed handshake is open; anything else is not. Leave the ports box empty for a standard set of 25 common services, or list your own - comma or space separated, 1 to 65535, at most 50 per scan:

22,80,443,8080        <- checks SSH, HTTP, HTTPS and HTTP alternate
25 465 587            <- spaces work too

Open ports carrying databases, remote desktop or file sharing - 3306, 3389, 445, 5432, 6379, 27017 and similar - are flagged for review, because those are normally restricted to trusted addresses rather than exposed to the internet.

What you are actually scanning

A hostname is resolved to an address first, so the scan hits whatever the A record currently points at. If that is a CDN or a load balancer, the result describes the proxy and tells you nothing about your origin server. Scan the origin's own address when that is what you care about.

"Closed or filtered" is one bucket on purpose. A port that refuses the connection and a port that silently drops the packet look identical to this kind of scan; only the second is a firewall, and separating them needs a timing-aware scanner.

Scan only hosts you own or have written permission to test. The connection is a real one, logged with our server's address, and unauthorised scanning breaches most hosting providers' acceptable-use policies.

Frequently asked questions

What does "closed or filtered" mean?

The port did not complete a handshake. Either nothing is listening and the host actively refused, or a firewall dropped the packet without answering. From outside, the two are indistinguishable.

Which ports should not be open to the internet?

Database and admin ports: 3306 MySQL, 5432 PostgreSQL, 1433 MS SQL, 6379 Redis, 27017 MongoDB, 3389 RDP, 5900 VNC and 445 SMB. Bind them to localhost or allow only known addresses; several major breaches began with an exposed 6379.

Why is port 443 open when my site is down?

Because something is listening there - often a CDN or load balancer in front of your server. The handshake succeeds at the edge while the origin behind it is failing, which is why an open port is not proof the application works.