Open ports
A port is like a door into your server for a specific service. Your website needs a couple of doors open, but databases, admin panels and test tools often end up reachable from the whole internet by accident.
- At a glance
- Group
- Security
- Mellonbot
- Explains, you decide
- What it does
- Lists them in plain English, with how to close them.
- Approval
- You make the change
What you’ll notice
- 01A database or admin tool can be reached from outside
- 02Security scanners report open ports you don’t recognise
- 03Unexpected connections in your logs
- 04Services left over from testing are still listening
Why it usually happens
- 01A service listens on every network address by default
- 02No firewall is set up, or it allows everything
- 03A test or development tool was never switched off
- 04Docker publishes a container’s port to the internet
Fix it yourself
How to fix it by hand
Comfortable with a terminal? Here’s what an experienced admin would do. Start with the read-only commands.
- 01
List everything that’s listening
Addresses like 0.0.0.0 or * mean “reachable from anywhere”.
sudo ss -tlnp - 02
Check the firewall
Shows which ports your firewall allows, if it’s on.
sudo ufw status verbose - 03
Check Docker’s published ports
Ports shown as 0.0.0.0:… are open to the internet.
docker ps --format "{{.Names}} {{.Ports}}" - 04
Close what shouldn’t be open
Make the service listen only on 127.0.0.1, or block the port in your firewall — for example, deny a public database port.
sudo ufw deny 3306/tcp
With Mellonbot
How Mellonbot helps
- Checks which services are reachable from the internet.
- Lists them in plain English, flagging the ones that shouldn’t be public.
- Shows you exactly how to close each one — firewall changes are yours to make.
- Scheduled checks tell you if a new port opens unexpectedly.
Not sure this is your problem? Ask us →
FAQ
Open ports: common questions
Which ports should be open on a web server?
Usually just 80 and 443 for the website, and SSH for you to log in. Databases and admin tools should normally only be reachable from the server itself.
Is it dangerous to have my database port open?
Yes. Anyone can try to log in to it, and databases are a favourite target. Keep it private unless you really need outside access.
Still have a question?
Every message goes straight to the founder.
Free plan · 100 credits to start
Let Mellonbot look after your website
Create a free account and connect your first site in a few minutes. Upgrade only when you need more.
- No card needed
- Leave any time
Prefer to talk first? Get in touch →
mellonbot — startfree- ✓ 100 credits to start
- ✓ No card needed
- ✓ One command to connect your site
Already have an account? Sign in