What is an open port scanner? Risky FTP/DB ports + free open port scanner
An open port is a TCP door on your server that answers when something knocks. People search “open port scanner,” “open ports checker,” or “is MySQL open on my host?” after a cloud rebuild or a “temporary” database expose. CrowWake’s free open port scanner knocks on a short list of risky services—the ones that should almost never face the whole internet on a brand hostname.
What is an open port scanner?
An open port scanner probes whether selected TCP services accept a connection on a hostname or IP. A full network scan can cover thousands of ports. CrowWake’s free open port scanner is narrower on purpose: fast TCP connects to a handful of services that, when left open on a public hostname, often mean a misconfigured VPS, forgotten FTP, or a database bound to 0.0.0.0. It is a rooster for obvious mistakes—not a replacement for a pen-test or Nmap sweep of your whole estate.
How to check open ports (free open port scanner)
1) Run the free open port scanner on the hostname users and mail hit (apex and www if both resolve publicly). 2) Note which labels:ports answer—FTP 21, Telnet 23, MySQL 3306, Postgres 5432, Redis 6379, MongoDB 27017. 3) Confirm where the hostname points (A/AAAA / CDN / VPS) so you know which box to fix. 4) After cloud rebuilds, security-group edits, or “temporary” database exposes, re-check—open ports often return when someone resets a firewall preset. 5) Pair with the security headers checker—headers and open ports are different classes of obvious public risk.
What CrowWake checks
We try TCP to ftp:21, telnet:23, mysql:3306, postgres:5432, redis:6379, and mongodb:27017 on the hostname you enter. Any that accept a connection → warn with the open list. None open → ok. The free open port scanner uses the same ports as the hourly flock probe, with no login. We do not brute-force logins or banner-grab beyond “did the TCP handshake complete?” CrowWake is not a full attack-surface map—this is the public risky-port pulse.
Open ports vs security headers
This guide is the definition and triage job: what an open port scanner is, which risky ports CrowWake watches, and how to check with the free open port scanner. Security headers (HSTS, framing, nosniff, HTTPS redirect) are HTTP response posture on the website—different door, same “did a deploy reopen something obvious?” habit. Use the security overview when you want both pictures; use this page when the question is FTP/DB/cache exposure.
Why these ports (and not everything)
FTP and Telnet are cleartext holdovers. MySQL, Postgres, Redis, and MongoDB are data stores that belong on private networks or firewalled admin IPs—not on the same public name as your marketing site. Operators searching “open port scanner” often want that early signal after a cloud rebuild or a forgotten expose—not a 65k-port inventory.
What “good enough” looks like
None of those six services answer on the public hostname. Databases and caches listen on localhost, a VPC, or a bastion allow-list. FTP/Telnet are off or replaced with SFTP/SSH. Shared hosting can still surprise you if the hostname resolves to a multi-tenant IP—treat a hit as “investigate,” then close or move the service.
Publish checklist when a port is open
1) Run the free open port scanner and note which labels:ports appear. 2) Confirm where the hostname points (A/AAAA / CDN / VPS). 3) On the host: stop the service, bind it to private IPs, or firewall the port to trusted sources only. 4) Re-run the free open port scanner until clean. 5) Add the domain so CrowWake crows if a port reappears after the next rebuild.
If CrowWake crows
Open risky ports → close or firewall them; do not ignore “it is only Redis on a staging IP” if that IP is still public. Present then gone then back → a deploy or security-group drift reopened the door. After a fix, re-run the free open port scanner and keep watching. Deep dives for HTTPS headers live in the HSTS, X-Frame-Options, X-Content-Type-Options, and HTTPS redirect guides—use the security overview when you want the whole flock picture.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free open port scanner / open ports checker with no login.
Deep dive: Security headers & open ports overview — headers vs FTP/DB/cache exposure on the same public hostname.
Related: security headers monitoring, SSL expiry, uptime monitoring, website monitoring, and the free security headers checker (headers are a different class of risk).