Free tool · Powered by Nmap
Free online port scanner
What it does: enter your public IP address or domain. FreshScanSentry runs Nmap against it from the internet, checks the 1,000 most common TCP ports, identifies the software answering on each open port, and runs Nmap's vulnerability-detection scripts on what it finds. Every result is rated High, Medium, Low or Info, with a short explanation and a fix.
Cost: free. No account, no card.
Why check your open ports from the outside
Every open port is a door into your network. Some are meant to be open, like a web server on port 443. Others got opened years ago for a vendor, a home-working setup or a test, and nobody closed them. Those forgotten ones are what attackers look for.
Testing from a computer inside your office only shows what is open on the office network. What matters is what your router or firewall lets through from the internet. An online port scanner tests from the outside, like an attacker would.
What the scan checks
- Which ports answer. The 1,000 most commonly used TCP ports, Nmap's default list.
- What is behind each one. Nmap's service detection (
-sV) names the program and, where it can, the version: for example OpenSSH 8.2, Apache 2.4 or Microsoft Remote Desktop. - Known weaknesses. Nmap's vulnerability scripts (
--script vuln) run against the open ports. They check for issues such as weak SSL/TLS settings, Heartbleed and POODLE, and match detected versions against public CVE lists. - How much it matters. Each finding gets a risk rating, a plain-language explanation and a fix. The whole result gets an A+ to F exposure grade.
The exact command is shown with your results, so your IT provider can check the work:
nmap -sV --script vuln your-domain-or-ip- 3389 Remote Desktop Reachable from the whole internet High
- 21 FTP Passwords travel unencrypted High
- 443 HTTPS web server Expected for a website Info
Ports that should not be open to the internet
These come up again and again on small business networks. Each links to a guide on what it means and how to close it.
| Port | Service | Why it's risky |
|---|---|---|
3389 | Remote Desktop (RDP) | Constant password guessing; a common ransomware way in |
445 | Windows file sharing (SMB) | Used by WannaCry-style worms |
21 | FTP | Logins and files travel unencrypted |
23 | Telnet | Unencrypted remote control, often on routers and cameras |
5900 | VNC | Remote screen access, sometimes with no password |
3306, 5432, 27017, 6379 | Databases | Data theft and ransom of the database itself |
Free scan or Deep Scan
Basic Scan Free
- 1,000 most common TCP ports
- Service and version detection
- Nmap vulnerability scripts
- Risk ratings, fixes and a grade
Deep Scan $59
- All 65,535 TCP ports
- Operating system fingerprinting
- OWASP ZAP test of your website
- Takes longer, by design
Common questions
Which ports does the free scan check?
The 1,000 most commonly used TCP ports, Nmap's default list. That covers Remote Desktop, file sharing, databases, FTP, Telnet, VNC, mail and web ports. Services moved to unusual high ports need the Deep Scan, which checks all 65,535.
Can I scan any IP address?
Only ones you own or have written permission to test. Scanning other people's systems without permission can break the law. You confirm authorization before each scan, and the confirmation is recorded.
Does a port scan change anything?
No. It connects to ports to see which answer and what software is behind them. It does not log in, change settings or install anything.
I don't know my public IP address.
Search "what is my IP" from a computer in the office, or scan your domain name instead, for example yourcompany.com.
Is UDP included?
No. Both scans check TCP ports, where most risky services such as Remote Desktop, file sharing and databases listen.