Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Is RDP open to the internet dangerous? Port 3389 explained for business owners

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 14 November 2026.

In one sentence: Yes: leaving Remote Desktop reachable from the internet gives anyone in the world a login screen to your Windows machines, and government agencies in the UK and US both tell you to close it or put it behind a VPN with multi-factor authentication.

What runs on this port

Remote Desktop Protocol (RDP) lets a person see and control a Windows computer from another device. CISA notes that “by default, RDP communicates over port 3389”. Staff, IT support and some software suppliers use it. This entry is the plain-English “should I worry?” answer. For the protocol detail see port-3389-rdp.

Why attackers look for it

Exposed services are found by scanning the internet, and search engines for devices list them. Microsoft’s security blog cites research by the founder of Shodan, the search engine for internet-connected devices, showing “the ongoing prevalent usage of RDP and its exposure to the internet”. An attacker does not need to know your company. They look for open doors.

How it gets attacked

The NCSC says ransomware is “increasingly” deployed by attackers who gained access through exposed services such as RDP. CISA says threat actors “often gain initial access” through exposed and poorly secured remote services, then move across the network using the native Windows RDP client.

The common weaknesses are not clever:

  1. Weak or reused passwords, tried repeatedly (see brute-force-attack and password-spraying).
  2. No multi-factor authentication on the login.
  3. Unpatched Windows or remote access devices.
  4. A forgotten server or test machine with the port forwarded.

An RDP login gives a full desktop. If the account is an administrator, the attacker gets administrator control.

Who it affects and how badly

  • Sole trader to 10 staff: Often a router rule set up by a supplier years ago. Worst case: ransomware on the office PC and server, days of downtime, and a possible personal data breach report to the ICO if client data is taken.
  • 10 to 50 staff: Accountancy and legal practices, recruitment, care providers. One compromised account reaches shared files. Worst case: lost client trust and a regulator report.
  • 50 to 250 plus and regulated firms: Councils, fintech, insurance, manufacturers. An exposed jump host or vendor server undoes other controls. Worst case: operations stopped and fines for failing to protect data.

What we check on a test

Method, not findings. A Wolfcore penetration test, with your written permission:

  • Looks for RDP or other remote desktop services reachable from the internet on your public addresses, including non-standard ports.
  • Notes whether the login is protected by a VPN, a gateway or multi-factor authentication.
  • Checks whether the server shows a login screen to anyone, and what an account with weak rights could reach after logging in.
  • Reviews whether remote access accounts are shared or over-privileged.

Worked example (illustration only)

A ten-person architecture practice lets its IT supplier connect to the office server. Years ago, the supplier forwarded port 3389 on the router. Nobody removed it. The server runs a shared “admin” account with a short password. An automated guesser succeeds. The attacker encrypts the project files and the backup drive attached to the server. Cost: a week without drawings, a ransom decision, and calls to clients. The fix would have been a firewall rule removed and a VPN with MFA.

Before: exposedAfter: gatedInternetWindows serverRDP 3389Open to anyoneInternetVPN+ MFARDPPort 3389 closed to the internet
Before: internet connects straight to RDP on port 3389. After: internet reaches a VPN with MFA, then RDP.

How to check whether yours is exposed

For the wider method, see how to check which ports are open on your network.

Safe checks, on systems you own or are authorised to test:

  1. Review your router or firewall rules for entries labelled “Remote Desktop” or “Terminal Services”. Microsoft says the default is TCP 3389 and an alternate port such as TCP 3388 is sometimes used.
  2. Audit your cloud services for virtual machines with a public address and an open management port.
  3. If you are in the UK, register your public IP addresses and domains with the free NCSC Early Warning service. NCSC suggests this if you are unsure whether you run RDP. It does not scan you itself, it uses information from other sources.
  4. Ask any IT supplier in writing whether they use remote access into your network.
  5. On a Windows server, check the Security log for event 4625 with Logon Type 10. Microsoft defines Type 10 as a user logging on “remotely using Terminal Services or Remote Desktop”. Failures from unfamiliar addresses are a warning sign.

How to secure it

  1. Do not expose RDP to the internet. CISA’s StopRansomware guide says not to expose services such as RDP on the web.
  2. If you need remote access, use a VPN that follows NCSC recommendations, with MFA, and add IP allow listing using hardware firewalls.
  3. Alternatively, use a zero-trust gateway. CISA says RDP should be reached through a secure VPN after MFA, or a zero-trust remote access gateway.
  4. Disable RDP where it is not needed. CISA says it can be disabled via Group Policy, or on single hosts with PowerShell and Windows Firewall.
  5. Enforce account lockouts after a set number of attempts, and log RDP login attempts (CISA).
  6. Block local accounts from remote access, and separate administrator accounts from daily accounts (CISA).
  7. Patch remote access and external-facing devices “immediately” (NCSC).
  8. Document any inbound rule you keep. Cyber Essentials v3.3 requires inbound rules to be approved, documented with the business need, and removed when no longer needed.

Related terms

Port 3389 (RDP), Port 445 (SMB), Port 5900 (VNC), Ports 5985 and 5986 (WinRM), Brute force attack, Password spraying, How to check open ports on your network

Back to the Ports, protocols and services hub.

Frequently asked questions

Is port 3389 always dangerous? CISA’s guidance is to disable RDP or put it behind a VPN with MFA, so direct exposure is the problem.

Does changing the port fix it? Not on its own. Microsoft notes some setups use an alternate port such as TCP 3388, so an audit has to look for those too.

Does Cyber Essentials allow RDP open to the internet? The requirements say unauthenticated inbound connections are blocked by default and inbound rules need a documented business need.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan or see penetration testing.