Cheat sheetWeb
Common ports
Which service runs on which port — web, mail, databases, infrastructure, and remote access — with the gotcha for each.
Last updated
Web
| Port | What runs there |
|---|---|
| 80 | HTTP, unencrypted — most browsers now show a warning before they'll even load it. |
| 443 | HTTPS — the padlock port, and the default for anything served over TLS. |
| 8080 | The classic 'alternate HTTP' port — common for dev servers and proxies that don't want to fight for 80. |
| 8443 | Alternate HTTPS — same idea as 8080, one layer of encryption up. |
| 3000 | The unofficial default for Node and React dev servers — so common that seeing it usually means a local app is running. |
| 5173 | Vite's default dev server port — if you've used Vite, you've seen this number. |
| Port | What runs there |
|---|---|
| 25 | SMTP between mail servers — most ISPs block outbound 25 to stop spam, so apps rarely use it directly. |
| 465 | SMTP over SSL from the start — the older 'implicit TLS' submission port. |
| 587 | SMTP submission with STARTTLS — the port your email client actually sends through. |
| 993 | IMAPS — reading mail over an encrypted connection. |
| 995 | POP3S — encrypted POP3, for the increasingly rare client that still downloads mail instead of syncing it. |
Data & cache
| Port | What runs there |
|---|---|
| 3306 | MySQL's default — anything connecting without a port specified is assuming this one. |
| 5432 | PostgreSQL's default — change it and half your connection strings still forget. |
| 6379 | Redis's default — no auth by default, which is why an exposed one shows up in security audits constantly. |
| 27017 | MongoDB's default — early versions shipped with no auth enabled, which is how so many databases ended up exposed. |
| 1433 | SQL Server's default — the one to know if your stack has any Microsoft in it. |
| 9200 | Elasticsearch's HTTP API — also infamous for shipping with no auth until you configure it. |
Infrastructure
| Port | What runs there |
|---|---|
| 22 | SSH — remote shell access, and the port every server scanner tries first. |
| 21 | FTP's control channel — plaintext by default, which is why SFTP (over 22) replaced it almost everywhere. |
| 53 | DNS — the lookup that turns a domain name into an IP, using both UDP and TCP. |
| 123 | NTP — keeps a machine's clock in sync, which matters more than it sounds for TLS and auth tokens. |
| 389 | LDAP — directory lookups, usually for corporate logins and Active Directory. |
| 636 | LDAPS — the encrypted version of 389, for the same directory lookups over TLS. |
Remote & messaging
| Port | What runs there |
|---|---|
| 3389 | RDP — Windows Remote Desktop, and a favorite target for brute-force scans. |
| 5900 | VNC — remote screen sharing, platform-agnostic where RDP is Windows-specific. |
| 5672 | AMQP — RabbitMQ's default, the protocol behind a lot of message-queue plumbing. |
| 9092 | Kafka's default — the port behind a lot of event-streaming pipelines you never see directly. |
Worth remembering
- →A port being open doesn't mean the service behind it is secured — Redis, MongoDB, and Elasticsearch have all shipped with no auth by default at some point.
- →Ports under 1024 need root or admin privileges to bind — one reason dev servers default to numbers like 3000 and 8080 instead.