2026-09-27 · IPV4 Scanner
A port is a numbered door on a machine, and each service listens on its own. Web traffic on 80 and 443, SSH on 22, mail on 25 and 587, and so on up to 65,535. "Is the port open" is one of those questions that sounds simple and has three possible answers, and the difference between them is where most of the useful information lives.
When you check a port, you get one of three results, and they mean different things.
Open means something accepted the connection. A service is listening and reachable. If you expected a service there, good. If you didn't, that's worth a look.
Closed means the host answered but nothing's listening on that port. The machine is up and reachable, the door's just shut. This is the normal, healthy state for the vast majority of ports.
Filtered means nothing answered at all. A firewall dropped the packet silently, so you can't even tell whether anything's behind it. Filtered is usually deliberate, and from a security angle it's often better than closed, because it gives an attacker nothing to work with.
Checking a port from the machine itself tells you almost nothing useful, because a service can be listening locally while the firewall blocks every attempt to reach it from the internet. The view that matters is the one from outside your network, since that's what decides whether anyone else can actually reach the service.
Our port scanner connects from outside, which is the honest test. If it reports 3306 as open on your server, that means your database is reachable from the public internet, which is almost never what you want. Testing from the box itself would have shown it listening and told you nothing about the exposure.
One rule that isn't optional: only scan hosts you own or have explicit permission to test. Scanning other people's machines is at best rude and at worst illegal depending on where you are.
Some services should never be reachable from outside your network, and finding them open is a genuine problem, not a curiosity. The database ports, 3306 for MySQL, 5432 for Postgres, 1433 for SQL Server, 27017 for MongoDB, 6379 for Redis. Remote access ports like 3389 for RDP and 5900 for VNC, which are relentlessly attacked. Windows file sharing on 445, which is how WannaCry spread. If a scan shows any of these open to the internet, treat it as something to fix today, not this week.
The pattern is simple. Databases, caches and admin interfaces belong on a private network or behind a VPN, reachable only by the application that needs them. If they're answering the public internet, automated scanning will find them, usually within minutes, and the exploits are all pre-written.
On a web server, 80 and 443 open is correct and expected. On a mail server, 25, 587 and 993 being open is the job. An open port isn't a problem in itself. The question is always whether that port should be open on that machine, and whether whatever's listening behind it is kept up to date. A current, well-configured service on an open port is fine. A forgotten one is the risk.
If you're not sure what a given number is for, our port reference covers the common ones, what each is for, and whether it's safe to leave open.
What does a filtered port mean?
Nothing answered, so a firewall almost certainly dropped the request without a reply. You can't tell whether a service is behind it, which is the point. Filtered is often the most secure result.
Is having open ports dangerous?
Only the wrong ones. A web server needs 80 and 443 open. What's dangerous is a database or remote-access port open to the internet, or an out-of-date service behind any open port. The port being open matters less than what's listening and whether it should be reachable.
Why does a port look open from my computer but closed from the scanner?
Because you're testing from different places. From inside your network the service is reachable. From outside, the firewall blocks it. The outside view is the one that tells you what the internet can reach.
How do I close a port?
You don't close the port so much as stop the service listening on it, or block it at the firewall. If you don't recognise a service that's listening, find out what it is before killing it, since some are meant to be there.
Can I scan any website's ports?
Only ones you own or have permission to test. Scanning machines you don't control can break the law depending on your jurisdiction, and it's poor form regardless. Stick to your own hosts.