Common ports every developer should know (22, 80, 443, 3306…)

There are 65,535 TCP ports and another 65,535 UDP ports, but you'll use the same couple of dozen over and over. Knowing them by number saves you constant lookups and — more importantly — helps you spot when something is listening that shouldn't be. Here's the working developer's port reference.

How ports are organised

Ports fall into three ranges:

• Well-known ports (0–1023) — assigned to standard services. Binding to these usually requires root.
• Registered ports (1024–49151) — used by specific applications (databases, dev servers).
• Dynamic/ephemeral ports (49152–65535) — assigned temporarily by the OS for outgoing connections.

Ports are also either TCP (connection-oriented, most services) or UDP (connectionless, used by DNS, some game and VPN protocols).

The essential dozen

These come up almost every day:

• 22 — SSH. Remote login and secure file transfer (SCP/SFTP). Your lifeline to a server.
• 80 — HTTP. Unencrypted web traffic; usually just redirects to 443 now.
• 443 — HTTPS. Encrypted web traffic. The port the modern web runs on.
• 53 — DNS. Name resolution (mostly UDP, TCP for large responses). If DNS is broken, nothing resolves.
• 25 — SMTP. Server-to-server mail delivery. Often blocked by providers to fight spam.
• 587 — SMTP submission. Where mail clients send outgoing mail (with authentication and TLS). Use this, not 25, for sending.
• 993 — IMAPS. Encrypted mailbox access for reading email.
• 21 — FTP. Legacy file transfer; prefer SFTP over port 22 instead.

Databases — keep these private

Database ports should almost never be exposed to the public internet. Bind them to localhost or restrict them to specific IPs:

• 3306 — MySQL / MariaDB.
• 5432 — PostgreSQL.
• 6379 — Redis. Historically unauthenticated by default — a notorious source of breaches when left open.
• 27017 — MongoDB. Same warning: many public MongoDB leaks trace to this port being exposed.
• 11211 — Memcached. Never expose it; it's been abused for huge amplification attacks.

If a port scan of your server shows any of these open to the world, treat it as an incident.

Web development and app servers

You'll recognise these from local development:

• 3000 — Node.js/React dev servers (Next.js, Create React App).
• 5173 — Vite dev server.
• 8080 — HTTP alternate; common for proxies, Tomcat, and app servers.
• 8000 — Django and Python dev servers.
• 5000 — Flask and some app servers (also used by macOS AirPlay, a frequent conflict).
• 9000 — PHP-FPM and various admin/monitoring UIs.

Infrastructure and tooling

• 2087 / 2083 — WHM / cPanel.
• 8090 — CyberPanel.
• 8006 — Proxmox web UI.
• 51820 — WireGuard VPN (UDP).
• 1194 — OpenVPN (UDP).
• 3389 — RDP (Windows Remote Desktop) — a top target for brute-force; never expose it raw.
• 9090 — Prometheus; 3001/3000 — Grafana.

Which ports to expose — and which to hide

A simple rule: expose the minimum. For a typical web server, only three ports need to face the internet:

• 22 (SSH — ideally rate-limited or key-only)
• 80 and 443 (web)

Everything else — databases, caches, admin panels, metrics — should be bound to localhost or reachable only through a VPN or a firewall allowlist. The fewer open doors, the smaller your attack surface.

A quick self-audit on any server:

sudo ss -tulpn

That lists every listening port and its process. Anything you don't recognise is worth investigating.

Check what's actually reachable

Knowing the numbers is half the job; the other half is confirming which are open from the outside. Our free port checker at /tools/port-checker tests any port on any host from the public internet, so you can verify 443 is reachable, confirm 3306 is *not* exposed, and catch a service that's accidentally listening on the world. It's the fastest way to audit your server's front door.

On a Nxeon VPS you get a dedicated public IP and full firewall control, so you decide exactly which of these ports the internet can see. Lock down everything but SSH and the web in a couple of commands. See /vps.