Skip to main content
Website AuditorWebsite Auditor

Online Port Scanner

Scan a website for exposed HTTP and HTTPS ports — dev servers, admin panels, cPanel, Webmin and monitoring dashboards accidentally left open to the public internet.

Probes 14 common web-service ports over HTTP/HTTPS with a 4-second timeout each. Free and unlimited.

What this tool checks

Every website should serve traffic on ports 80 and 443 — anything else exposed to the public internet is usually a mistake. We probe 14 well-known web ports (dev servers, admin panels, control panels, monitoring dashboards) and flag any that respond so you can lock them down behind a firewall, VPN or authentication.

This is an HTTP-level probe: we detect services that speak HTTP or HTTPS on each port. Non-web protocols (SSH, FTP, databases) require a native TCP scanner — for those, run nmap from a machine you own.

Ports we scan

  • 80 — HTTP
  • 443 — HTTPS
  • 8080 — HTTP-Alt
  • 8443 — HTTPS-Alt
  • 8000 — HTTP-Dev
  • 8888 — HTTP-Alt
  • 3000 — Node/Dev
  • 5000 — Flask/Dev
  • 7001 — WebLogic
  • 9000 — SonarQube
  • 9090 — Prometheus
  • 2082/2083 — cPanel
  • 10000 — Webmin

Frequently asked questions

We send an HTTP or HTTPS request to each port on the target host with a short timeout. If we get any response, the port is open and speaking HTTP; no response within 4 seconds means the port is closed or filtered by a firewall.
We probe 14 common web-service ports: 80, 443, 2082, 2083, 3000, 5000, 7001, 8000, 8080, 8443, 8888, 9000, 9090 and 10000. These cover standard HTTP/HTTPS, dev servers, cPanel, Webmin, WebLogic, SonarQube and Prometheus.
No. This is an HTTP-level probe — we only detect services that speak HTTP or HTTPS. For SSH (22), FTP (21), SMTP (25) or databases, use a native TCP scanner like nmap from a machine you own.
Passive port probing of a public host is generally legal, but active scanning without permission can violate terms of service or computer-misuse laws in some jurisdictions. Only scan sites you own or have permission to test.
Port 8080 is the default for Tomcat, Jenkins, staging environments and many admin dashboards. If it's open on production, an attacker can browse to admin panels that were never meant to be public.
No. Results are returned to your browser and discarded — nothing is logged or shared.

Want a full security review? Run a complete website audit.