Private and internal addresses (localhost, 10.x, 172.16-31.x, 192.168.x, 169.254.x, .local) are refused, because they cannot be reached from the internet and probing them would be an SSRF.
| Port | Service | Result | Time |
|---|---|---|---|
| No results yet. Enter a host and the ports you want tested, then press Check Ports. | |||
Why Check a Port?
When an application works on your own machine and refuses to work for everyone else, the cause is almost always a port. A service has to listen on a port, something has to let the traffic through the firewall, and the person on the other side has to know which port to aim at. Get any one of those three wrong and you get a connection that times out or is refused. The fix is usually small, but only if you know which of the three failed. This tool answers that question by opening a real TCP connection to the host you name, from outside your network, and telling you what happened.
Most free checkers answer with two words, open or closed, and that is where they go wrong. A closed port got a connection refused, which means the host is reachable and something answered, it just does not listen on that port. A filtered port never answered at all. The packets went into a firewall and were dropped. The second case is the one that costs people hours, because the two look identical from inside your own network, where your own firewall is usually the thing doing the dropping. That is why this tool keeps them apart and reports the round trip time for every port it opens.
Two things are worth knowing before you trust any result, including this one. First, a hostname that sits behind Cloudflare's proxy does not answer on the machine you are probably trying to test. The proxy answers on Cloudflare's network, and it only terminates HTTP and HTTPS on a fixed list of ports. Everything else on that hostname is unreachable from the internet no matter what your origin server is doing, which is why a scan of an orange cloud record can look perfectly healthy while SSH still refuses. Second, this checker runs from a data centre network, which some hosting providers and corporate firewalls treat very differently from a home connection. If a port shows as filtered here and works for you locally, the block is on the path between here and there rather than on the server itself.
The tool deliberately refuses to guess. If it cannot measure something, it says so and explains why, instead of returning a confident answer that is quietly wrong.
What the four results mean
- Open — a TCP handshake completed. Something is listening and reachable from the internet.
- Closed — the host answered with a reset. It is up and reachable; nothing is listening on that port.
- Filtered — no answer at all within the timeout. A firewall or a network policy is dropping the packets.
- Blocked / not measurable — this checker refused to measure rather than guess. Port 25 and Cloudflare addresses land here.
If You Are Behind Cloudflare
If you are hosting behind Cloudflare, the record for your hostname usually shows an orange cloud, which means the traffic is proxied rather than sent straight to your server. That proxy only accepts HTTP and HTTPS, and only on a fixed set of ports. On the HTTP side that is 80, 8080, 8880, 2052, 2082, 2086 and 2095. On the HTTPS side it is 443, 2053, 2083, 2087, 2096 and 8443. A port outside those lists is not proxied at all, so the hostname simply will not answer on it. SSH on 22 is the classic case: it works perfectly, it is just not reachable through the proxy, and the fix is to grey cloud that particular hostname, or to buy Spectrum if you need arbitrary ports. The reverse trap is that Cloudflare keeps ports other than 80 and 443 open on its own anycast addresses so that it can serve other customers on them. A scanner that hits a Cloudflare address can therefore report a port open when nothing of yours is listening on it. Cloudflare's own documentation warns about exactly this.
For the same reason this tool cannot give you a real answer for any hostname that resolves to a Cloudflare address, and it will say so instead of printing a false closed. To test your actual origin server, look up the origin IP and check that address, not the proxied hostname.
Why Port 25 Is Never Reported as Open
Port 25 deserves a separate mention. It is the ordinary SMTP port and you will see it closed on almost every modern server on purpose, because unrestricted outbound mail is how spammers borrow a server. Cloudflare Workers will not open an outbound connection to port 25 at all, so this checker reports it as blocked rather than pretending to have measured it. If you are sending mail from a server, use submission on port 587 with authentication, which is what mail providers expect these days.
Where the Test Comes From
The last honest caveat is where the test comes from. Every result here is produced by a data centre network a few milliseconds away from Cloudflare, not from your home or office. Providers and corporate firewalls treat those two very differently, so a port that is filtered in this report may well be open on your own connection, and a port that is open here tells you nothing about whether your own firewall permits it. Use the report to narrow down where the problem is, then confirm from the network you actually care about.
Why AI Cannot Do This For You
A language model has no socket. It cannot open a connection to your server, and it cannot tell you whether port 5432 answered with a reset or with nothing at all. What it can do is repeat the difference between open and closed from a text it read somewhere, which is exactly the distinction that does not help when you are stuck. This tool makes the connection and reports what came back, including the cases it is not allowed to answer.
Port Ranges
Ports are IANA names for numbers. 0-1023 are the well-known ports, 1024-49151 are registered ports, and 49152-65535 are dynamic or private. 90 of the common ones are named in the results table so you do not have to remember which number is PostgreSQL.
Why does a port show as filtered instead of closed?
Because nothing answered. A closed port sends a reset straight back, which proves the host is alive and reachable. A filtered port times out, which means a firewall between here and there dropped the packets on purpose. Filtered is the more interesting answer, because the problem is not on your server at all.
Why can this tool not check my Cloudflare hostname?
Cloudflare blocks outbound TCP connections to its own network, and a proxied hostname resolves to a Cloudflare address. Even if the connection were allowed, the answer would describe Cloudflare's edge rather than your server, which is not the thing you are trying to test. Look up the origin IP and check that instead.
Does an open port mean I have a security problem?
Not by itself. An open port means something is listening and reachable. Whether that is a problem depends entirely on what is listening and whether it needs to be reachable from the whole internet. An open SSH port with key-only login is normal. An open database port on a home connection is worth closing.
Why is port 25 reported as blocked instead of open or closed?
Cloudflare Workers are not permitted to make outbound connections to port 25 at all. Reporting blocked is the honest answer; reporting closed would claim the measurement happened when it did not.
Can I check my own computer or local network?
No. Private and internal addresses are refused, because they cannot be reached from the internet and scanning them would be an abuse of this server. To test your own machine, run nc -vz 127.0.0.1 3000 in a terminal.
How many ports can I check at once?
Twenty-five per run, as individual ports, comma separated lists, or ranges such as 8000-8010. They are tested three at a time so the scan stays gentle on the host.
Comments & Ratings