Free Open Port Scanner & Service Banner Analyzer

Scan your domain hostname or public IP address to identify exposed TCP/UDP listening ports, detect insecure administrative consoles, inspect service banners, and eliminate attack surface blind spots.

host://
Scan Common Ports

Scans ports: 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 3306, 3389, 5432, 6379, 8080, 8443.

Port Discovery Engine v4.8Perimeter Audited

$ wesecurex-recon --ports top-100 --target example.com

[OPEN] Port 80/tcp: HTTP (nginx/1.24.0) -> Redirects 301 to https://example.com/

[OPEN] Port 443/tcp: HTTPS (nginx/1.24.0) -> TLS 1.3 Active, HSTS Enabled

[FILTERED] Port 22/tcp: SSH (Firewall Blocked / IP Whitelisted)

[CLOSED] Port 3306/tcp: MySQL (Not exposed publicly)

[CLOSED] Port 6379/tcp: Redis (Not exposed publicly)

[STATUS] Clean External Perimeter: 0 Unauthorized Services Exposed

Critical Ports & Exposure Risk Assessment

Port 21 / TCPFTP

Critical if exposed without TLS; vulnerable to anonymous brute-force.

Port 22 / TCPSSH

Target for continuous dictionary attacks; must use key-based auth & Fail2ban.

Port 80 / TCPHTTP

Unencrypted plaintext traffic; should automatically 301 redirect to HTTPS.

Port 443 / TCPHTTPS

Standard web transport; requires TLS 1.2+ and strong cipher suites.

Port 3306 / TCPMySQL

Severe risk; exposes database tables directly to remote SQL exploits.

Port 5432 / TCPPostgreSQL

Severe risk; databases must be restricted to VPC private subnets.

Port 6379 / TCPRedis

Critical; unauthenticated Redis instances permit remote code execution.

Port 8080 / TCPHTTP Alt / Proxy

Frequently used for dev backends, Jenkins, or Tomcat consoles.

Need Automated Continuous Audits?

Upgrade from Single-Check to External Attack Surface Reconnaissance (EASM)

24/7 continuous discovery of subdomains, open ports, and shadow IT. Scale with automated schedules, Slack alerts, 150+ monthly credits, and compliance PDF exports on our paid tiers.

Subdomain discovery via Certificate TransparencyFull 65,535 TCP/UDP port mappingSSL/TLS certificate expiration monitor
Explore Paid Plans (from $9/mo)Launch Free Instant DAST Scan

Frequently Asked Questions

Why are open ports a critical security risk for web servers?

Every open network port represents an entry point listening for inbound traffic. If a daemon listening on that port has known vulnerabilities, weak credentials, or outdated software (such as OpenSSH or MySQL), attackers can exploit it to execute arbitrary code or penetrate your private network.

Which ports should always remain closed to the public internet?

Database ports (MySQL 3306, PostgreSQL 5432, MongoDB 27017, Redis 6379), remote management ports (RDP 3389, Telnet 23), and internal services (Elasticsearch 9200, Memcached 11211) should never be exposed to the public internet. They should only be accessible via private VPNs or localhost bindings.

How does WeSecureX perform non-disruptive port scans?

WeSecureX executes TCP SYN / ACK half-open handshakes that test connection state without opening full application-layer sessions. This minimizes bandwidth and avoids triggering aggressive rate limiters or crashing fragile legacy daemons.

What is service banner grabbing?

Banner grabbing is a reconnaissance technique where the scanner inspects the initial welcome string returned by a listening service (such as 'SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5'). This reveals exact software versions to cross-reference against known CVE vulnerability databases.