How it works
Every service on a server listens on a port: web servers on 80 and 443, mail servers on 25, MySQL on 3306, PostgreSQL on 5432, RDP on 3389. If a port accepts connections from any address on the internet, the service is “open”, whether or not a password sits in front of it.
On a web server, only the ports visitors actually need should be reachable from outside. Databases, caches such as Redis or Memcached, remote access (RDP, VNC, Telnet), file sharing (SMB) and admin interfaces like the Docker API belong behind a firewall, inside a VPN or on localhost.
Often nobody opens these ports on purpose: a Docker container publishes its port on all interfaces, a server image starts MySQL without binding it to localhost, or a firewall rule added for a test simply never gets removed.
Why it matters
Automated scanners sweep the entire IPv4 internet around the clock looking for open database and remote access ports. A reachable Redis without a password, a MongoDB with default settings or an RDP login with a weak password then leads to data leaks, ransomware or a hijacked server.
FTP and POP3/IMAP without TLS send credentials in plain text. And even a well-protected service widens the attack surface, because any vulnerability in its software can be exploited straight from the internet.
How to prevent it
- Bind databases and caches to localhost or a private network instead of all interfaces.
- Block everything except the ports you need in the firewall, and allow remote access only through a VPN or from fixed addresses.
- Replace FTP with SFTP, and use IMAPS and POP3S on ports 993 and 995 for fetching mail.
- With Docker, check which ports are published with -p and bind them to 127.0.0.1 where needed.
- After every server setup and hosting migration, check from the outside which ports respond.
How DomainWarn detects it
The Open services check opens TCP connections once a day to a short, fixed list of ports on the website and mail server addresses – no port scan, no banner grabbing, no data. Open database and cache ports (1433, 1521, 3306, 5432, 6379, 9200, 11211, 27017) and remote access or file sharing ports (23, 3389, 5900, 445, 2375) are critical and open the incidents “Database port open” or “Remote access port open”. FTP (21) and POP3/IMAP without TLS (110, 143, mail servers only) are warnings with their own incidents, while SSH and common alternative ports (22, 8080, 8443, 8000, 9000) are informational notes.
Expected services such as SSH on your own server can be marked as “expected” so they no longer count. Hosts behind a CDN are skipped because the provider’s servers answer there, and mail servers run by third parties such as Google or Microsoft are left out. The operator enables the check deliberately, and it is available from the Freelancer plan up; a newly opened or closed port shows up in the timeline.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.