What is an open port scanner? Risky ports in plain English
An open port is a TCP door on your server that answers when something knocks. CrowWake’s free open port scanner knocks on a short list of risky services—the ones that should almost never face the whole internet on a brand hostname.
What an open port scanner does
A full network port scan can probe thousands of ports. CrowWake’s open port scanner is narrower on purpose: fast TCP connects to a handful of services that, when left open on a public hostname, often mean a misconfigured VPS, forgotten FTP, or a database bound to 0.0.0.0. It is a rooster for obvious mistakes—not a replacement for a pen-test or Nmap sweep of your whole estate.
What CrowWake checks
We try TCP to ftp:21, telnet:23, mysql:3306, postgres:5432, redis:6379, and mongodb:27017 on the hostname you enter. Any that accept a connection → warn with the open list. None open → ok. The free open port scanner uses the same ports as the hourly flock probe, with no login. We do not brute-force logins or banner-grab beyond “did the TCP handshake complete?”
Why these ports (and not everything)
FTP and Telnet are cleartext holdovers. MySQL, Postgres, Redis, and MongoDB are data stores that belong on private networks or firewalled admin IPs—not on the same public name as your marketing site. Operators searching “open port scanner” often want that early signal after a cloud rebuild or a “temporary” database expose that never got closed.
What “good enough” looks like
None of those six services answer on the public hostname. Databases and caches listen on localhost, a VPC, or a bastion allow-list. FTP/Telnet are off or replaced with SFTP/SSH. Shared hosting can still surprise you if the hostname resolves to a multi-tenant IP—treat a hit as “investigate,” then close or move the service.
Quick triage when a port is open
1) Run the free open port scanner and note which labels:ports appear. 2) Confirm where the hostname points (A/AAAA / CDN / VPS). 3) On the host: stop the service, bind it to private IPs, or firewall the port to trusted sources only. 4) Re-run the scanner until clean. 5) Add the domain so CrowWake crows if a port reappears after the next rebuild. Pair with the security headers checker—headers and open ports are different classes of “obvious public risk.”
If CrowWake crows
Open risky ports → close or firewall them; do not ignore “it is only Redis on a staging IP” if that IP is still public. Present then gone then back → a deploy or security-group drift reopened the door. After a fix, re-run the free open port scanner and keep watching. Deep dives for HTTPS headers live in the HSTS, X-Frame-Options, X-Content-Type-Options, and HTTPS redirect guides—use the security overview when you want the whole flock picture.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free open port checker with no login.
Related: security headers monitoring, security headers & open ports overview, SSL expiry, uptime monitoring, website monitoring, and the free security headers checker (headers are a different class of risk).