How to Check Open Ports on Your Business Network Safely

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 14 November 2026.

In one sentence: An open port is a door on a computer that listens for connections, and checking which doors your business has open to the internet means comparing three lists: what your firewall allows, what you think you run, and what the outside world can actually reach.

What it is

Every networked device runs services, and each service listens on a numbered port. Web traffic uses 80 and 443, for example. The NCSC Cyber Essentials requirements say the aim of the firewall control is to make sure “only secure and necessary network services can be accessed from the internet”.

A port check is a review of that. It is not an attack and it should only ever be done on addresses you own or have written permission to test.

How it works

There are three views, and you need all of them because each misses something:

The inside view. Your firewall or router rules, and the list of what each server is meant to run.
The outside view. What a stranger on the internet sees when they look at your public IP addresses.
The feed view. What other people’s scanning data says about your addresses.

The gap between the first and second view is where problems live: a rule someone forgot, a test server, a supplier’s remote access.

The UK angle

Three official routes all use the outside view:

NCSC Early Warning. Free for UK organisations. You give your public IP addresses and domain names, and the NCSC emails alerts. One alert type is “Vulnerability and Open Port Alerts”, for example an exposed Elasticsearch service. The NCSC states it “does not conduct any active scanning of your networks itself” and uses information from other sources, so silence is not proof of safety.
Cyber Essentials firewalls. The v3.3 requirements say to “block unauthenticated inbound connections by default”, to have inbound rules “approved and documented by an authorised person” with the business need, and to remove rules no longer needed.
Cyber Essentials Plus. IASME says the audit includes “an external scan from the internet against each one of the applicant’s public IP addresses” to check for vulnerabilities or open services that could be publicly discovered.

What we check on a test

Method, not findings. In an external test, with permission, a Wolfcore tester:

Builds a list of your public addresses and domains, including ones you may have forgotten (old subdomains, supplier-hosted systems).
Finds which services answer, on standard and non-standard ports.
Identifies what each service is and its version, then checks it against known weaknesses.
Tests whether each exposed login is protected by MFA or an allow list.
Compares the result to your firewall rules and asset list and reports the differences.

Who it affects and how badly

Sole trader to 10 staff: A router forwarding rule set up for a supplier. Worst case: one exposed service leads to ransomware on the only server.
10 to 50 staff: Retail, hospitality, trades and construction firms with a mix of tills, cameras and servers. Worst case: a forgotten device is the way in.
50 to 250 plus: Fintech, insurance, schools and councils with many suppliers. Worst case: an exposed management service on a supplier-run system.

Worked example (illustration only)

A 25-person recruitment firm moved to Microsoft 365 but kept an old file server. The server’s remote desktop port (port 3389) was forwarded years ago. Nobody lists it, because it is not on the asset sheet. Registering with Early Warning flags an open port alert. The firm closes the rule in minutes and starts an asset list. Cost of finding out the easy way: an email. Cost of finding out the hard way: a ransomware recovery.

Three lists compared: firewall rules, asset list, outside view. The differences are the problem.

How to detect it

List your public IP addresses with your internet provider, router and cloud accounts.
Review firewall rules for anything labelled Remote Desktop, Terminal Services, FTP, Telnet or database. Microsoft recommends auditing firewall policies and scanning internet-exposed address ranges and cloud services.
Check cloud security groups for management ports open to any address.
Register with NCSC Early Warning if you are a UK organisation. If you find remote desktop exposed, read is RDP open to the internet dangerous.
If you use a free scanner such as Nmap, only run it against addresses you own or have written permission to test. See nmap.
Run the free web vulnerability scan on your website. It is a web vulnerability scan, so treat it as a website check, not a full network port check.

How to fix or prevent it

Close every port with no documented business need. CISA says to disable ports and protocols not used for business, giving RDP on TCP 3389 as an example.
Put the remaining remote access behind a VPN with MFA.
Write down each inbound rule, who approved it and why.
Review the list every quarter and when a supplier changes.
Keep exposed services patched (see cyber-essentials-14-day-patch-rule).
Run regular vulnerability scanning of internet-facing devices, as CISA’s StopRansomware guide recommends.

Back to the Security tools and testing methods hub.

Frequently asked questions

Does NCSC Early Warning scan my network? No. The NCSC says it does not conduct active scanning itself.

Is an external scan part of Cyber Essentials Plus? Yes. IASME lists an external scan of each public IP address.

Can I scan any address I like? No. Only addresses you own or have written permission to test.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan or see penetration testing.

How to check which ports are open on your business network