Port Check

Scanning main TCP ports of the server: HTTP, SSH, SMTP, MySQL and more.

Open port checker

The scanner connects in turn to 21 common TCP ports on a server — web (80, 443, 8080, 8443), SSH, FTP, mail, DNS, databases (MySQL, PostgreSQL, Redis, MongoDB), RDP and VNC — and shows which ones accept connections from the internet. The check runs from our server, so “closed” can mean a closed port or one filtered by a firewall.

21 common TCP ports in one scan

Connection time for every open port

Accepts an IP address or a domain

An outside view: what any client on the internet sees

How to Use

Enter the server's IP address or domain
Wait while 21 ports are tested (up to 2 seconds each)
Compare the open ports with what really should be reachable from the internet

FAQ

Enter the server's IP address or domain. The scanner tries a TCP connection to each of 21 ports and marks the open ones. To test one specific port yourself, run nc -zv example.com 443 on Linux or macOS, or Test-NetConnection example.com -Port 443 on Windows.

21, 22, 23, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 3306, 3389, 5432, 5900, 6379, 8080, 8443 and 27017. The list is fixed; you cannot choose your own port or range.

“Closed” means our server could not connect within 2 seconds. Usually the service listens on 127.0.0.1 only, a firewall or cloud security group blocks the port, access is limited to certain IPs, or port forwarding is not set up on the router.

The scanner does not check local addresses like 192.168.x.x, because it works from the internet. To test port forwarding, enter your public IP. If your ISP uses CGNAT, forwarding will not work from outside without a dedicated public IP.

No, TCP only. Port 53 is tested over TCP, and UDP-based services such as WireGuard or many game servers cannot be checked this way.

Which ports the scanner checks

The tool tries to open a TCP connection to each of 21 common ports in turn and waits up to 2 seconds for each. A port is marked open when the server accepts the connection, and the connection time is shown in milliseconds. The port list is fixed:

Ports	Service	Should it be open to the internet?
80, 443, 8080, 8443	HTTP, HTTPS and alternative web ports	Yes, if the server hosts a website
22	SSH	Acceptable, ideally key-only and restricted by IP
21, 23	FTP, Telnet	Better not: passwords travel in plain text. Use SFTP and SSH instead
25, 465, 587	SMTP, SMTPS, SMTP with STARTTLS	Only on a mail server
110, 995, 143, 993	POP3, POP3S, IMAP, IMAPS	Only on a mail server, preferably the encrypted ones
53	DNS (over TCP)	Only on a DNS server
3306, 5432, 6379, 27017	MySQL, PostgreSQL, Redis, MongoDB	No. Databases exposed to the internet are a classic cause of data leaks
3389, 5900	RDP, VNC	No, put them behind a VPN

What “closed” means

“Closed” in the report means one thing: our server could not establish a connection within 2 seconds. Several situations look the same, and the scanner does not tell them apart:

The port is really closed: nothing listens on it and the server refuses the connection.
The port is filtered: a firewall, a cloud security group or a router silently drops the packets.
The service listens on an internal address only, for example MySQL on 127.0.0.1. That is the correct setup.
Access is limited by IP: the port is open to an allowlist that does not include our server.

So “closed” means “not reachable from the internet from our server”, not proof that the service is off. If the result is not what you expect, test again from another network, for example with the commands below.

The check runs from the internet, not from your computer

Our server opens the connections, so the scanner sees what any outside client would see. Two things follow:

Local addresses cannot be checked. 192.168.x.x, 10.x.x.x, 127.0.0.1 and other private or reserved addresses are not scanned. To test port forwarding on your home router, enter your public IP; What is my IP shows it.
CGNAT. If your ISP gives you an address from 100.64.0.0/10 or shares one public IP among many customers, port forwarding on your router will not work from outside. Ask the ISP for a dedicated public IP.

Entering a domain instead of an IP

For a domain, the scanner takes its public IP address and checks the ports there. If the site is behind Cloudflare or another CDN, you are scanning the CDN edge, not your server: web ports will be open and SSH or databases closed, even if they are open on the origin. Every address of a domain and a CDN flag are shown by domain to IP lookup.

How to check a port yourself

nc -zv example.com 443                     # Linux, macOS
Test-NetConnection example.com -Port 443   # Windows PowerShell
ss -tlnp                                   # ports the server itself listens on (Linux)
sudo ufw status                            # UFW firewall rules

ss -tlnp shows whether a service listens on the port and on which address: 0.0.0.0 or [::] means all interfaces, 127.0.0.1 means local only. If the service listens but the port is closed from outside, look at the server firewall, your cloud provider's security group or the router's port forwarding.

Limitations

TCP only. UDP services such as WireGuard, most game servers and DNS over UDP cannot be tested this way.
The list of 21 ports is fixed; you cannot pick a custom port or range.
The scanner does not detect software versions or look for vulnerabilities. For web servers see server info and the security headers check.
Only scan servers you own or have permission to test.