Encrypted web traffic, and now effectively the default for the entire web. It carries HTTP/1.1 and HTTP/2 over TLS, and HTTP/3 over QUIC on UDP 443. Because it is almost never blocked, it has also become the port a great many non-web protocols tunnel through to get out of restrictive networks.
The port is not the risk; what runs behind it is. Keep TLS configuration current, disable old protocol versions, and remember that encryption says nothing about whether the application behind it is sound.
Open 443 is the normal state of a web server, so there is nothing to close. Check the TLS configuration and certificate expiry instead, and remember the port being encrypted says nothing about the application behind it.
The port scanner will tell you whether 443 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.