A port is the number that tells a server which program a connection is for: 443 for the web server, 22 for SSH, 25 for mail. A hosting admin meets perhaps twenty of the 65,535. Knowing them means being able to read a firewall rule, diagnose "connection refused", and notice when something is listening that should not be.
Web
| Port | Protocol | Use |
|---|---|---|
| 80 | HTTP | plain web; should redirect to 443 |
| 443 | HTTPS | the web; also HTTP/3 over UDP 443 |
| 8080, 8443 | HTTP(S) alt | Plesk (8443), Tomcat, dev servers |
| 2082/2083, 2086/2087 | cPanel / WHM | cPanel's panel ports |
Remote access
| Port | Protocol | Use |
|---|---|---|
| 22 | SSH / SFTP | Linux admin and file transfer |
| 3389 | RDP | Windows remote desktop |
| 21 | FTP | plain-text file transfer — avoid; use SFTP |
| 990 | FTPS | FTP over TLS |
| 5900 | VNC | console access, usually via provider |
| Port | Protocol | Use |
|---|---|---|
| 25 | SMTP | server-to-server delivery; often blocked outbound on VPSs to stop spam |
| 465 | SMTPS | client submission over TLS |
| 587 | Submission | client submission with STARTTLS |
| 143 | IMAP | mailbox access, STARTTLS |
| 993 | IMAPS | mailbox access over TLS |
| 110 / 995 | POP3 / POP3S | download-and-delete access |
DNS and time
| Port | Protocol | Use |
|---|---|---|
| 53 | DNS (UDP and TCP) | lookups; TCP for large answers and zone transfers |
| 853 | DNS over TLS | encrypted DNS |
| 123 | NTP (UDP) | time sync |
Databases and caches — keep these closed
| Port | Service |
|---|---|
| 3306 | MySQL / MariaDB |
| 5432 | PostgreSQL |
| 6379 | Redis |
| 11211 | Memcached |
| 27017 | MongoDB |
None of these should be reachable from the internet. Bind them to 127.0.0.1, and if a remote application must connect, use an SSH tunnel or a VPN. An exposed Redis with no password is compromised within hours.
Panels and tools
| Port | Service |
|---|---|
| 8443 / 8880 | Plesk (HTTPS / HTTP) |
| 10000 | Webmin |
| 9090 | Cockpit |
| 2222 | DirectAdmin |
| 51820 (UDP) | WireGuard |
| 1194 (UDP) | OpenVPN |
What is listening on my server?
sudo ss -tulpnEach line is a listening socket: protocol, local address:port, and the process. 0.0.0.0:3306 means MariaDB accepts connections from anywhere; 127.0.0.1:3306 means local only. This one command is the audit.
Is the port reachable from outside?
From another machine:
nc -zv 203.0.113.10 443 # TCP check
nmap -p 22,80,443,3306 203.0.113.10nmap reports open, closed (reachable, nothing listening) or filtered (a firewall dropped the probe). Only scan machines you own.
From the server itself, to see whether outbound is blocked (common for port 25):
nc -zv smtp.gmail.com 25Reading firewall rules
A minimal web server allows in: 22 (ideally from your IP only), 80, 443. Add 25/465/587/993 for a mail server, 8443 for Plesk (again, ideally restricted), 53 if it serves DNS. Everything else is denied. Setting that up: configure a firewall with ufw or firewalld.
Two things about port numbers
Ports below 1024 need root to bind, which is why web servers start as root and drop privileges. And the port number is not a security measure: moving SSH to 2222 removes noise, not risk. Security comes from what is listening and how it authenticates, not from where.
VPSPioneer managed VPS plans are handed over with only the ports the workload needs open, and a monthly report of what is listening — the ss -tulpn above, read by someone whose job it is.