How the port check works
Our server tries to open a TCP connection to the host and port you enter. If the other side accepts the connection within a few seconds, the port is open. If it refuses or never answers, the port is closed from the internet's point of view. No data is sent after the connection is made, so the check doesn't care which protocol runs on the port, and it won't trip login-attempt alarms on SSH or mail servers.
You choose what "OK" means. Most of the time you want a service to be reachable, so "port should be open" is the default. The opposite is just as useful: a database, Redis or an admin panel should never face the public internet, and "port should be closed" confirms that the firewall actually blocks it.
Open, closed, filtered
Network tools often distinguish three states. A closed port belongs to a reachable machine that answers "nothing here". A filtered port is one where a firewall drops packets silently, so the connection attempt just hangs. This tool reports both as closed, since in both cases nobody outside can connect, and that's the question it answers.
If a port is open on the server itself (you can see the process listening with ss -tlnp or netstat) but the check says closed, the usual suspects are:
- a firewall on the machine (ufw, firewalld, Windows Defender Firewall),
- a cloud firewall or security group that only allows your own IP,
- the service bound to
127.0.0.1instead of0.0.0.0, so it only accepts local connections, - a home router without port forwarding, or a provider that blocks the port (residential ISPs often block 25).
Remember that the request comes from our servers, not from your computer. If you allow-list IP addresses, the check will see what any other stranger sees.
Ports people check most often
22 SSH, 21 FTP, 25 / 465 / 587 SMTP, 993 IMAPS, 80 / 443 HTTP and HTTPS, 3306 MySQL, 5432 PostgreSQL, 6379 Redis, 27017 MongoDB, 3389 Remote Desktop. For the last few, a closed result is usually the good news.
Only TCP is checked. UDP services like DNS on port 53 or WireGuard can't be tested this way, because UDP has no handshake to complete.
Get alerted when a service stops listening
A crashed mail server or an SSH daemon that didn't come back after a reboot keeps its port closed until someone notices. A Port monitor runs this check every minute and tells you the moment the port changes state, in either direction.