Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 10 November 2026.

Part of the Wolfcore Resources library: Ports, protocols and services.

In one sentence: Port 993 is the encrypted door that email apps use to read mail stored on a server, and the risk is rarely the encryption itself but who is allowed to sign in through it, and how.

What runs on port 993 (IMAPS)

IMAP lets an email app read and organise mail that stays on the server, so you see the same inbox on phone and laptop. Port 993 is the standard port for IMAP wrapped in TLS from the first byte. RFC 8314 describes this: for the “imaps” service (default port 993), a TLS handshake begins immediately. This is called implicit TLS. The older port 143 starts in plain text and may upgrade using a command called STARTTLS.

RFC 8314 recommends that mail apps and providers discourage and then deprecate cleartext protocols for mail access and submission. So 993 is the right port to use. The question is whether it should be reachable at all.

Why attackers look for it

Mail servers sit on the internet by design, so port 993 is easy to find with internet-wide scanning. It is an attractive target because it accepts a username and password and leads straight to a mailbox. Attackers try lists of passwords against many accounts, which is the pattern described in password spraying and brute force attacks.

How it gets attacked

• Weak or reused passwords. The server cannot tell a guess from a real user if only a password is needed.
• Legacy sign-in that skips MFA. Microsoft says Basic authentication makes it easier for attackers to capture credentials, and enforcing multifactor authentication is not simple or in some cases possible while it is enabled.
• Old or misconfigured servers. Self-hosted mail servers with outdated software or weak TLS settings. No specific CVE is cited here because the risk depends on the product you run; check your vendor’s advisories.
• Cleartext fallback. Servers that still allow port 143 without TLS expose passwords on the network.

Who it affects and how badly

• Sole trader to 10 staff: one mailbox taken over. Worst case: fraudulent invoices sent from a trusted address.
• 10 to 50 staff (estate agents, recruitment, trades): a hijacked mailbox used to redirect payments or harvest client details.
• Regulated firms (legal, fintech, care): mailboxes hold personal data. Worst case: a reportable breach and a hard conversation with clients.

What we check on a test

• Whether 993, 143, 995 and 110 answer from the internet, and which of them offer plain-text login.
• Which TLS versions and certificates the server presents.
• Whether legacy sign-in works without MFA for accounts in scope.
• Whether the server limits repeated failed logins.
• Whether sign-in attempts to IMAP appear in your logs.

The UK angle

Cyber Essentials requires multi-factor authentication for administrative accounts and accounts that are accessible from the internet, per the NCSC requirements v3.3. A mailbox reachable over IMAP with only a password is exactly that kind of account. The NCSC’s email security guidance also says your service should be capable of sending and receiving email using TLS.

Diagram

How to check whether yours is exposed

1. In Microsoft 365, check that POP3 and IMAP4 are off for users who do not need them. Microsoft states POP3 and IMAP4 are enabled by default for all users in Exchange Online, and are disabled automatically if security defaults are on.
2. Check your sign-in logs for IMAP as the client app.
3. If you run your own mail server, list its open ports from your firewall rules.
4. Run the free web vulnerability scan as a first outside view.

How to secure it

1. Turn IMAP off for every user who does not need it.
2. Use modern authentication with MFA, and block legacy Basic authentication.
3. Where IMAP must stay, use port 993 only and close cleartext port 143.
4. Require current TLS versions and a valid certificate.
5. Limit failed sign-ins with lockout or throttling.
6. Review sign-in logs for IMAP from unexpected countries.

FAQ

Is port 993 safe? The encryption is the right choice. Safety depends on how users sign in.

What is the difference between 143 and 993? 143 starts in plain text and may upgrade. 993 starts encrypted.

Is IMAP on by default in Microsoft 365? Yes for Exchange Online users, unless security defaults are on.

Related terms

port-143-imap, port-110-pop3, port-25-smtp, password-spraying, multi-factor-authentication, brute-force-attack, port-995-pop3s

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan or see penetration testing.