Online Port Scanner: Check Open Ports
Scans 20 common TCP ports for reachability. Critical database and admin ports (MySQL, RDP, SSH, Redis, MongoDB) are highlighted — they do not belong on the public internet.
What does the port scan check?
The port scan tests 20 common TCP ports on your domain for reachability — including web (80, 443), SSH (22), RDP (3389), MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017), FTP (21) and SMTP (25). Critical database and remote-administration ports are flagged in red, because they have no business being open to the internet.
Why it matters
Any openly reachable admin or database port is a direct way in. Redis and MongoDB historically shipped with no password — exposed to the internet, that meant a full data leak. RDP and SSH are constant targets of automated brute-force attacks. Services like these belong behind a firewall, a VPN or at least an IP restriction — not open to the internet.
How to read the result
80 and 443 being open is normal for a web server. SSH (22) open is acceptable if the access is hardened (key authentication, no root login) — better still, restricted to known IPs. Red-flagged database ports (3306, 5432, 6379, 27017) showing open means: act immediately and put them behind a firewall. Closed or filtered is the state you want for anything that doesn't need to be public.
Frequently asked questions about Port scan
Is an open SSH port (22) automatically a problem?
Not necessarily, but it's a risk. With key authentication and an IP restriction it's acceptable; open to the whole world it attracts brute-force attacks.
Why are open database ports so dangerous?
Databases are often weakly authenticated or not at all. Exposed, that can mean direct full access to all your data.
What's the difference between “filtered” and “closed”?
Closed actively replies with a rejection, filtered silently drops the request (typical of a firewall) — both keep the service unreachable from outside.
Am I allowed to run a port scan?
On your own domains, any time. Scan systems you don't own only with explicit permission.
Need the full audit? The full Webscan Radar security check combines Port scan with all other areas plus GDPR audit, CMS detection, CVE matching and performance measurement in one report — also free.