Open
Something accepted a connection from our server, so it will accept one from anywhere. Whether that is fine depends entirely on which port.
Checks 32 well-known service ports on the address the internet sees you from. Takes up to half a minute.
There is no address field. The scan runs against the address your request arrived from, so it cannot be pointed at anyone else — which is exactly what makes scanning every port at once something we are willing to offer.
Something accepted a connection from our server, so it will accept one from anywhere. Whether that is fine depends entirely on which port.
Actively refused. Your address is reachable and nothing is listening there — a clean, definite answer.
Silently dropped, almost always by a firewall. We learnt nothing, because this looks identical to an address with nothing behind it — and it is the normal result for a well-configured connection.
RDP, SMB, the database ports, Redis, Elasticsearch, VNC, SSH. These are scanned for continuously by everyone, and exposing one is a different category of problem from having a web server.
UPnP.Most consumer routers let a device on the network ask for a port to be forwarded, and grant it without telling anyone. A games console, a camera, a NAS or a piece of software can open a path from the internet into your network with nobody deciding to. If the scan finds something you did not configure, the router’s UPnP table is the first place to look — and turning UPnP off is a reasonable default for a business network.
A forward somebody set up years ago. Port 3389 opened for one person working from home in 2020, or 445 opened to move some files once. These outlive their purpose and nobody remembers them. Exposed RDP in particular is the single most common way ransomware gets into a small business network.
A service bound to every interface. A database or cache started with its default configuration listens on all addresses, not just the local one. Redis has no authentication at all by default, and an exposed instance is trivially readable and writable by anyone who finds it. If the scan shows 6379, 27017, 3306, 5432 or 9200 open, treat it as an incident rather than a to-do.
Your ISP’s equipment, not yours.On a shared or carrier-NAT connection the address we see may not be exclusively yours, and an open port may belong to the provider’s router rather than anything of yours. If a result makes no sense against what you run, that is worth considering before you go looking for a device.
Yes — it checks all 32 well-known service ports in one pass. What it will not do is scan a host you type in, because probing ports on a host that did not ask is port scanning, and doing that from one address on behalf of strangers is how a hosting account gets suspended. The target is always the address your request came from. If you only want one port re-checked after a firewall change, the port checker does the same thing for a single port and answers immediately.
Because those are different facts and the difference is the useful part. A refusal means something at your address is reachable and actively declining — definite information. No answer at all means a firewall dropped the connection silently, and that is indistinguishable from an address with nothing behind it. Most scanners report both as closed and throw the distinction away.
For a home or office connection with no inbound services, yes — that is exactly what you want to see, and it is the normal result when a router has no port forwards configured. It means none of the common exposures are reachable from outside.
Find out what is behind it before closing anything, because something may depend on it. Check your router for a port forward or UPnP mapping — UPnP lets a device on your network open a port without anyone deciding to, and it is the usual explanation for a surprise. If the port is one of the sensitive ones the scan flags, treat it as urgent: RDP, SMB, Redis and the database ports exposed to the internet are actively scanned for and exploited within hours.
No, and it is worth being precise about why. This covers 32 of 65,535 TCP ports, so a service on an unusual port would not appear. It does not test UDP at all. And it says nothing about the security of whatever is listening on the ports that are open, or about anything reached from inside your network. It tells you the common inbound exposures are closed, which is one useful thing among many.
No. It is 32 TCP connection attempts, eight at a time, which is less traffic than loading a web page. Some firewalls and intrusion-detection systems will log it as a port scan, which is them working correctly — if you run such a system, you may see an alert naming our server.
An expired certificate, a missing header or an exposed port is a finding. Knowing which of them matters on your estate, fixing them without breaking the application, and noticing the next one before a stranger does is the work. That is what we do, continuously rather than as a report.