How it works
Once a day, we scan every TCP port (1 to 65535) of your server's IP address: the origin IP if you set one on the monitor, otherwise the address your host name resolves to. We compare the open ports with the ports you expect to be open, which are 80 and 443 by default.
Databases, caches, admin panels and remote desktops reachable from the internet are one of the most common ways in for attackers. Bots scan the whole internet for them around the clock.
Set the expected ports and the origin IP when you edit the monitor. If your site is behind a CDN or proxy, set the origin IP so we scan your real server instead of the CDN.
Statuses
| Status | Meaning |
|---|---|
| OK | Only the expected ports are open. |
| Warning | The host name could not be resolved. |
| Failed | A port is open that should not be, or an expected port is closed. |
By default you are notified of warnings and failures.
Fixing common problems
- Unexpected open port: close it in the server's firewall, or bind the service to
127.0.0.1or a private network. Common culprits are MySQL (3306), PostgreSQL (5432), Redis (6379), Elasticsearch (9200) and development servers. - The port is supposed to be open: add it to the monitor's expected open ports.
- Expected port closed: the service is down or a firewall rule changed.