Open Ports: What They Are and Why They're a Security Risk

Emil Gheonea

Software engineer & founder of LinkThreatScan · 9 March 2026

Network ports are numbered logical channels through which network communications travel. A web server accepting HTTPS connections does so on port 443. An email server receiving mail typically listens on port 25. When a port is 'open', it means a service on the server is actively listening for connections on that port. Every open port that isn't needed for the server's legitimate function is unnecessary attack surface.

How port scanning works

A port scanner sends connection requests to a target IP address across a range of port numbers and observes the responses. An open port responds with a SYN-ACK (accepting the connection). A closed port sends a RST (reset). A filtered port provides no response, suggesting a firewall is silently dropping the packet. From these responses, a scanner can map which services are potentially accessible on a host.

High-risk ports to watch for

Certain ports are particularly dangerous to leave open when exposed to the internet. Port 23 (Telnet): completely unencrypted remote access, effectively obsolete and exploited by many botnets. Port 21 (FTP): also transmits credentials in plain text. Port 3389 (RDP): Windows Remote Desktop, frequently targeted by brute-force and ransomware campaigns. Port 3306 (MySQL) and 5432 (PostgreSQL): databases exposed directly to the internet with no firewall are a critical risk. Port 27017 (MongoDB): misconfigured MongoDB instances have leaked hundreds of millions of records.

What open ports reveal about a site's security posture

A web server that exposes nothing beyond ports 80 and 443 (and perhaps 22 for SSH, tightly restricted) demonstrates good security hygiene. A server that exposes database ports, development services, or legacy protocols publicly suggests the operator has either not audited their configuration or doesn't understand the risk. For the purposes of evaluating a website, unexpected open ports are a meaningful negative signal.

Firewalls and port filtering

The standard recommendation is to expose only the ports your service genuinely requires, filtered to the smallest possible set of source IPs where feasible. Cloud providers (AWS, Google Cloud, Azure) offer security group rules that act as stateful firewalls. On-premises and VPS deployments should use host-based firewalls like iptables or nftables as a baseline. Our scanner reports which ports are open and flags any that are unexpected or high-risk for a web service.