Common Ports Reference

Inspect standard & security-sensitive TCP/UDP ports, vulnerabilities, and hardening tips.

> search:

Protocol:

Risk:

:20TCPFTP Data(File Transfer Protocol (Data))

Warning Risk

Used by active FTP servers for transferring actual file content.

⚠️ Security Risk:Unencrypted traffic. Credentials and file contents sent in cleartext.

🛡️ Mitigation:Use SFTP (SSH Port 22) or FTPS (TLS).

:21TCPFTP Control(File Transfer Protocol (Control))

Critical Risk

Command and authentication channel for FTP servers.

⚠️ Security Risk:Sends usernames and passwords in cleartext. Vulnerable to sniffing and brute-force.

🛡️ Mitigation:Disable FTP; migrate to SFTP (port 22).

:22TCPSSH / SFTP(Secure Shell / Secure FTP)

Standard Risk

Encrypted remote terminal access and secure file transfer.

⚠️ Security Risk:Frequent target for automated brute-force botnets when left on default port.

🛡️ Mitigation:Disable password login, use Ed25519 public keys, configure fail2ban.

:23TCPTelnet(Telnet Remote Login)

Critical Risk

Legacy unencrypted command-line terminal interface.

⚠️ Security Risk:Transmits all keystrokes and passwords in plaintext over the wire.

🛡️ Mitigation:Disable immediately. Replace with SSH.

:25TCPSMTP(Simple Mail Transfer Protocol)

Warning Risk

MTA server-to-server email routing.

⚠️ Security Risk:Open relays can be abused for spam campaigns and spoofing.

🛡️ Mitigation:Enforce STARTTLS, SPF, DKIM, DMARC, and restrict relaying.

:53TCP/UDPDNS(Domain Name System)

Warning Risk

Translates human domain names into IP addresses.

⚠️ Security Risk:UDP DNS servers can be used in amplified Distributed Denial of Service (DDoS) reflection attacks.

🛡️ Mitigation:Disable open recursive resolvers; implement DNSSEC and rate-limiting.

:80TCPHTTP(Hypertext Transfer Protocol)

Warning Risk

Unencrypted web traffic protocol.

⚠️ Security Risk:Subject to Man-in-the-Middle (MitM) eavesdropping, session hijacking, and injection.

🛡️ Mitigation:Redirect all port 80 traffic to HTTPS (port 443) with HSTS enabled.

:110TCPPOP3(Post Office Protocol v3)

Critical Risk

Client-side email retrieval protocol.

⚠️ Security Risk:Unencrypted passwords and message content sent over network.

🛡️ Mitigation:Use POP3S (Port 995 with SSL/TLS) or IMAPS (Port 993).

:123UDPNTP(Network Time Protocol)

Warning Risk

Clock synchronization across network devices.

⚠️ Security Risk:Often abused in massive UDP amplification DDoS attacks (monlist vulnerability).

🛡️ Mitigation:Disable monlist feature; restrict NTP server access to internal subnets.

:143TCPIMAP(Internet Message Access Protocol)

Warning Risk

Synchronizes emails across multiple devices in real time.

⚠️ Security Risk:Cleartext credentials without STARTTLS.

🛡️ Mitigation:Use IMAPS (Port 993) with strict TLS certificates.

:389TCP/UDPLDAP(Lightweight Directory Access Protocol)

Critical Risk

Directory services and corporate identity authentication.

⚠️ Security Risk:Cleartext directory queries leak corporate user accounts and password hashes.

🛡️ Mitigation:Use LDAPS (Port 636) with TLS or StartTLS.

:443TCPHTTPS(Hypertext Transfer Protocol Secure)

Standard Risk

Encrypted web communications via TLS/SSL.

⚠️ Security Risk:Safe protocol, but requires strong cipher suites (TLS 1.2/1.3) and valid certificates.

🛡️ Mitigation:Use modern TLS ciphers, disable SSLv3/TLS 1.0/1.1, and enable HSTS.

:445TCPSMB / CIFS(Server Message Block)

Critical Risk

Windows file, printer, and IPC sharing.

⚠️ Security Risk:High-value attack vector for ransomware (EternalBlue, WannaCry, NotPetya).

🛡️ Mitigation:Block port 445 at WAN firewall. Never expose SMB to the public internet.

:993TCPIMAPS(IMAP over SSL/TLS)

Standard Risk

Encrypted email synchronization.

⚠️ Security Risk:Safe when configured with modern TLS certificates.

🛡️ Mitigation:Enforce TLS 1.2/1.3 and require multi-factor authentication (MFA).

:995TCPPOP3S(POP3 over SSL/TLS)

Standard Risk

Encrypted email download protocol.

⚠️ Security Risk:Safe standard for legacy POP3 clients.

🛡️ Mitigation:Use valid SSL certificates and strong passwords.

:1433TCPMS SQL(Microsoft SQL Server)

Critical Risk

Relational database engine for Microsoft SQL Server.

⚠️ Security Risk:High target for automated password brute-force and remote code execution exploits.

🛡️ Mitigation:Bind to localhost/VPC only; use VPN/SSH tunnel for remote administrative access.

:1521TCPOracle DB(Oracle Database Listener)

Critical Risk

Default listener port for Oracle database instances.

⚠️ Security Risk:TNS listener poisoning and brute-force attacks.

🛡️ Mitigation:Restrict access via security groups; never expose to public IP.

:3306TCPMySQL / MariaDB(MySQL Database Server)

Critical Risk

Default connection port for MySQL and MariaDB databases.

⚠️ Security Risk:Frequent target for credential stuffing and database dumping.

🛡️ Mitigation:Bind to 127.0.0.1; enforce TLS; use VPN or private subnet for app servers.

:3389TCP/UDPRDP(Remote Desktop Protocol (Windows))

Critical Risk

Microsoft graphical remote desktop management.

⚠️ Security Risk:Top attack vector for ransomware gangs (BlueKeep vulnerability, brute force).

🛡️ Mitigation:Never expose port 3389 directly. Use WireGuard/VPN or Azure Bastion + MFA.

:5432TCPPostgreSQL(PostgreSQL Database)

Critical Risk

Relational database management system.

⚠️ Security Risk:Unauthorized connections can dump or corrupt database contents.

🛡️ Mitigation:Configure pg_hba.conf strictly, enforce SSL, and place behind private VPC.

:6379TCPRedis(Redis In-Memory Data Store)

Critical Risk

In-memory key-value cache and database.

⚠️ Security Risk:Historically shipped without default password. Exposed Redis allows instant root RCE via crontab overwrite.

🛡️ Mitigation:Bind to 127.0.0.1 only, set strong `requirepass`, rename dangerous commands (FLUSHALL, CONFIG).

:8080TCPHTTP-Alt / Proxy(Alternative Web Server / Tomcat)

Warning Risk

Often used for web development, proxy servers, Spring Boot, or Apache Tomcat.

⚠️ Security Risk:Often left unprotected with default administrative credentials (e.g. Tomcat manager).

🛡️ Mitigation:Place behind reverse proxy with TLS and authentication.

:8443TCPHTTPS-Alt(Alternative HTTPS / Admin Panels)

Standard Risk

Encrypted alternative web port, common for web control panels (Plesk, UniFi).

⚠️ Security Risk:Targeted for router and management panel exploits.

🛡️ Mitigation:Restrict access by IP allowlist and enforce strong 2FA.

:9200TCPElasticsearch(Elasticsearch REST API)

Critical Risk

Distributed search and analytics engine REST interface.

⚠️ Security Risk:Exposed Elasticsearch clusters frequently leak millions of records to automated scrapers.

🛡️ Mitigation:Enable X-Pack security, set API keys, and block public WAN traffic.

:27017TCPMongoDB(MongoDB Database Instance)

Critical Risk

NoSQL document database default port.

⚠️ Security Risk:Frequently ransomed when exposed without authentication.

🛡️ Mitigation:Enable `security.authorization: enabled` in mongod.conf; bind to private IP.