Are my ports open or exposed? How to check safely

Quick answer

If you’re worried about whether your computer’s ports are “open to the internet,” the reassuring short answer is: on a normal home or office connection, almost certainly not. Your router and its firewall block unsolicited incoming connections by default. Here’s what port exposure actually means, why a website can’t (and shouldn’t) scan your machine to tell you, and how to check honestly.

What “an open port” really means

A port is a numbered channel a service listens on — web servers on 80/443, SSH on 22, databases on 3306 or 5432, and so on. A port is only meaningfully “exposed” if something on the public internet can reach a service listening on it. Two separate things have to both be true: a service is running and listening, and your network is configured to forward outside traffic to it. On a default home setup, the second condition is false — so even if you run a local web server, the wider internet can’t reach it.

Why isn’t my localhost on the internet?

Services you run on your own machine usually bind to 127.0.0.1 (localhost) or a private LAN address like 192.168.x.x. Those addresses are non-routable — they exist only inside your own computer or local network and can never be reached from the public internet. A dev server on localhost:3000 is visible to you and nothing else. So “is my localhost port open?” and “is my connection exposed to the internet?” are completely different questions — the first tells you nothing about the second.

Can a website scan my ports for me?

You’ll find pages claiming to “scan your ports” from inside your browser. Be wary of them. A website probing your own machine’s localhost is a known hostile technique — browsers, antivirus tools, and security software flag it as exactly the kind of thing malware does, and modern browsers actively block cross-origin requests to private addresses. Beyond being intrusive, it’s also useless: your localhost services aren’t internet-reachable anyway, so a browser “finding” them tells you nothing about your real exposure. We don’t do this, and you shouldn’t trust a site that does.

The honest way to check your public exposure

To learn what’s actually reachable from outside, the check has to come from the outside — not from your own browser. The legitimate approach is to run a scan against your public IP from a separate network, or use a reputable external port-scanning service that connects to your address from its own servers. Tools network professionals use for this include nmap (run from a different machine or network) and well-known online port-check services. These connect to your public IP the way a real outside party would, which is the only way to get a truthful answer.

Checking what’s listening on your own machine

If you instead want to see which services are listening locally — useful when developing or hardening a server — you run a command on the machine itself, where you have the right to inspect it:

Linux/macOS: ss -tulpn (or netstat -tulpn)
Windows: netstat -ano

That lists the ports your machine is listening on and which process owns each. It’s the right tool for “what’s running on my computer” — and notice it runs on your machine, with your permission, not from some random web page.

If you’re behind CGNAT, you’re doubly shielded

Many home and mobile connections sit behind carrier-grade NAT, where you share a public IP with many other customers and can’t accept inbound connections at all. If you’re on CGNAT, nothing on your machine is reachable from the internet even if you tried to expose it — which is also why hosting a game server from such a connection needs a workaround. You can get a sense of your situation by checking whether your public IP matches what your router reports.

When ports genuinely are exposed

Real exposure happens when you’ve deliberately forwarded a port in your router to a device, or you’re on a server with a public IP and no firewall in front. If you’ve set up port forwarding for a game or a home server, that specific port is reachable — so keep the service behind it updated and password-protected. The fix for unwanted exposure is straightforward: remove port-forwarding rules you no longer use, and don’t expose services that don’t need to be public. See whether someone can hack you with your IP for the broader picture on what your address does and doesn’t expose.