Attackers don't knock on your website's front door — they scan every port on your server, thousands of times a day, looking for an open one. An open port is an invitation to try: automated bots probe the most common ones first, and if anything answers, they test it for weak passwords and known bugs.
Here are the ports they target most — and what to do about each:
21 (FTP) — Old, insecure file transfer. If you're not actively using FTP, close it and switch to SFTP.
22 (SSH) — Your server's admin door. Never leave it wide open: restrict access to your own IP, disable password logins, and use SSH keys.
23 (Telnet) — Completely unencrypted. There is no good reason for this to be open on a web server. Close it.
80/443 (HTTP/HTTPS) — These must stay open for your site to work, but make sure 80 redirects to 443, not to an outdated admin panel.
3306 (MySQL) — Your database port. It should never be reachable from the internet — bind it to localhost or your private network only.
3389 (RDP) — Windows remote desktop. A favorite ransomware target; if you don't use it, close it.
8080 (alt HTTP) — Often runs forgotten admin tools or staging sites. Check what's answering before you leave it open.
Quick lockdown checklist: list what's actually listening (your host's firewall panel usually shows this), close anything you don't recognize or use, and never expose admin or database ports to the public internet.
Want to see which doors are open on your site right now? Run a free scan at https://vulnerabilitytools.com/ and fix what's exposed before someone else finds it.
