How to check which ports are open on your server

Every open port is a possible entry door. Regularly check what is listening on the server and close what you do not use.

1. See open ports locally

ss -tulnp

Shows all services listening for connections, with the port and process.

2. Scan from the outside

From another computer, see what is visible from the internet:

nmap SERVER_IP

3. Close what you do not need

Stop unnecessary services:

systemctl disable --now service-name

Or block the port with a firewall, see How to set up a firewall with UFW.

4. Good rules

• Publicly expose only 80 and 443 for sites, plus the SSH port.
• Databases stay accessible only locally or through a firewall restricted to an IP.
• Run this check after every new install, some packages open ports by default.

A full check is part of the first steps of securing your VPS.