Nmap Port Scanning

What this check looks for

StackShield scans your server's network-reachable ports and reports which services are listening and accessible from outside. It is building the same picture an attacker builds first: what is exposed, beyond the web application itself.

A production web server should present very little to the internet, typically ports 80 and 443. Everything else that answers is worth questioning.

Why it matters

Every open port is a service, and every exposed service is attack surface. Databases, cache servers, admin panels, queue dashboards and SSH are frequently left reachable from the whole internet when they only need to be reachable from a handful of hosts. An exposed database port means the only thing between an attacker and your data is a password. An exposed Redis or Elasticsearch instance often has no password at all by default.

The web application is usually the hardened front door. Open ports are the windows left unlatched around the side, and attackers check them first because they are so often forgotten.

What a failed check means

A failed check means a port beyond the expected web ports was reachable from outside. That is not automatically a vulnerability, but each one is a service that should be justified, firewalled to specific sources, or closed.

The remedy is a default-deny firewall that exposes only the web ports publicly and restricts everything else to the specific hosts that need it. Run a free scan to see exactly what your server is presenting.