Port Information Database: Common TCP/UDP Ports & Services

HTTP (HyperText Transfer Protocol) is the application-layer protocol for transmitting web pages and APIs between browsers and servers. HTTP transfers all data including form inputs and session cookies in plain text, making it vulnerable to interception on shared or public networks. Modern web standards require HTTPS (port 443) for all sites that handle user data. Redirect all port 80 traffic to port 443.

HTTPS is HTTP secured with TLS (Transport Layer Security), providing encryption, server authentication, and data integrity for web communications. It became the web standard after Let's Encrypt made free TLS certificates widely available in 2016. TLS 1.3 (RFC 8446) is the current recommended version, with TLS 1.0 and 1.1 officially deprecated. Browsers display security warnings for any site without HTTPS.

Port 8080 is the most common alternative HTTP port, used when port 80 is unavailable or requires elevated OS privileges. It is the default for Apache Tomcat, Jetty, and many development web servers. HTTP proxy and caching servers also commonly listen on port 8080. Users must specify the port explicitly in the URL since browsers do not assume port 8080.

Port 8443 serves as an alternative HTTPS port when port 443 is in use or restricted. It is commonly used by control panels (Plesk, cPanel), Kubernetes API servers, and Java application servers with TLS enabled. Apply the same TLS security standards as port 443: valid certificate, TLS 1.2 minimum, strong cipher suites.

SMTP (Simple Mail Transfer Protocol) is the standard protocol for routing email between mail servers on the internet. Port 25 is used for server-to-server (MTA) delivery and is blocked by most ISPs on residential connections to prevent spam. Authenticated submission from mail clients uses port 587 (STARTTLS) or port 465 (implicit TLS). SMTP servers must implement anti-relay protections to prevent being used as open spam relays.

POP3 (Post Office Protocol v3) allows email clients to download messages from a mail server to a local device. Unlike IMAP, POP3 typically deletes messages from the server after download. POP3 in plain-text mode sends credentials unencrypted — use POP3S (port 995) with TLS instead. For multi-device access, IMAPS (port 993) is generally preferred.

IMAP (Internet Message Access Protocol) lets email clients access and sync messages stored on a mail server, keeping messages available across multiple devices. Unlike POP3, IMAP leaves messages on the server and synchronises folder organisation and read/unread states. IMAP in plain-text mode (port 143) should be upgraded to STARTTLS or replaced with IMAPS (port 993), which uses TLS from connection start.

SMTPS wraps SMTP in implicit TLS from the moment a connection is established, originally assigned to port 465. This port was briefly deprecated in 1998 but restored by RFC 8314 in 2018 as a modern alternative to STARTTLS on port 587. Major providers including Gmail and Microsoft 365 support port 465 with implicit TLS.

SMTP Submission (port 587) is the current standard for authenticated email submission from mail clients to their outgoing mail server. It mandates STARTTLS to encrypt the connection before credentials are transmitted. Unlike port 25, port 587 requires authentication, preventing unauthorised relay. All major email providers recommend port 587 for client SMTP configuration.

IMAPS is IMAP secured with TLS applied immediately at connection start, before any credentials are exchanged. This eliminates the risk of credential interception present in plain-text IMAP. IMAPS on port 993 is the recommended configuration for all modern mail servers. Disable plain IMAP (port 143) once all clients support IMAPS.

POP3S is POP3 with TLS applied from the very start of the connection, encrypting messages and authentication tokens. POP3S on port 995 is the secure alternative to plain POP3 (port 110). For multi-device access with server-side message retention, IMAPS (port 993) is generally preferred over POP3S.

SSH (Secure Shell) provides an encrypted tunnel for remote login, command execution, and file transfer over untrusted networks. SSH version 2, defined by RFC 4251–4254, replaced the original SSH-1 protocol after critical security flaws were discovered. It supports key-based authentication as a more secure alternative to password login. Common implementations include OpenSSH (default on Linux and macOS), Dropbear (embedded devices), and Bitvise (Windows).

Telnet was the original standard for remote terminal access before SSH existed. It transmits all data — including usernames and passwords — in plain text over the network. Any attacker with packet-sniffing access can capture Telnet credentials instantly. Telnet was deprecated in favour of SSH and should never be used on any modern system.

RDP (Remote Desktop Protocol) is Microsoft's protocol for graphical remote control of Windows systems over port 3389. It provides full desktop access including audio, clipboard, and drive redirection. Exposed port 3389 is a primary ransomware attack vector — operators use brute-force and credential stuffing to gain access. Always use a VPN instead of exposing RDP directly and enable Network Level Authentication (NLA).

VNC (Virtual Network Computing) implements the RFB protocol (RFC 6143) to share and control a graphical desktop remotely over port 5900. It transmits screen pixels, mouse, and keyboard input. Standard VNC sessions are unencrypted — always tunnel VNC over SSH (ssh -L 5900:localhost:5900) or use a VPN before connecting. Implementations include RealVNC, TigerVNC, and macOS Screen Sharing.

Microsoft SQL Server uses port 1433 as its default TCP port for client connections, implementing the Tabular Data Stream (TDS) protocol. It supports both Windows Authentication and SQL Server Authentication, with Windows Authentication preferred in domain environments. Exposing port 1433 directly to the internet is a critical security risk — use a VPN or SSH tunnel for remote access.

MySQL is one of the world's most widely deployed open-source relational databases, listening on port 3306 by default. MariaDB, a community fork, also uses port 3306 and is compatible with MySQL clients. Both support SSL/TLS connections, but these must be explicitly configured. Bind port 3306 to localhost in my.cnf and use an SSH tunnel for remote database management.

PostgreSQL is a powerful open-source relational database listening on port 5432 by default. It supports advanced SQL with JSONB, full-text search, PostGIS extensions, and complex queries. PostgreSQL uses pg_hba.conf to control host and user access, and supports TLS for encrypted connections. Set listen_addresses to localhost and use an SSH tunnel or VPN for remote access.

Redis is an in-memory key-value store used for caching, session management, pub/sub messaging, and real-time leaderboards. It has no authentication by default in older versions. Exposed Redis instances have been repeatedly abused for data theft and cryptomining. Always bind Redis to 127.0.0.1, enable requirepass, and never expose port 6379 to the internet.

MongoDB is a document-oriented NoSQL database storing data in BSON format, listening on port 27017 by default. It shipped with no authentication enabled by default in early versions, leading to mass data exposures. Enable authentication (security.authorization: enabled in mongod.conf), bind to localhost, and use TLS for any remote connection. Never expose port 27017 to the internet.

Port 25565 is the default TCP port for Minecraft Java Edition dedicated servers. Players connect by entering the server IP in the Minecraft client. Server software variants include the official Mojang server, Paper, Spigot, Fabric, and Velocity. Open port 25565 only when actively hosting a server and use a whitelist to control who may join.

Port 27015 is the default UDP port for Valve's Source engine dedicated server software, used by Counter-Strike 2, Team Fortress 2, Left 4 Dead 2, and Garry's Mod. The Source engine also uses this port for Steam Server Browser queries. Keep the server binary updated via SteamCMD and set a strong RCON password.

DNS (Domain Name System) translates human-readable domain names into IP addresses. DNS uses UDP for queries under 512 bytes and falls back to TCP for larger responses. A recursive resolver queries multiple authoritative servers to resolve a domain on the client's behalf. Open DNS resolvers can be abused in amplification DDoS attacks.

OpenVPN is an open-source VPN protocol that creates encrypted tunnels using TLS. It defaults to UDP port 1194 for performance but can operate over TCP for firewall traversal. OpenVPN supports certificate-based authentication and strong cipher suites including AES-256-GCM. It is supported by major router firmware distributions including pfSense, OPNsense, and DD-WRT.

FTP uses a separate data channel (port 20) for transferring file content in active mode. The control connection on port 21 negotiates the transfer, while port 20 carries the raw data stream. FTP-Data traffic is unencrypted — file contents travel in plain text. Use SFTP (port 22) or FTPS for secure file transfers.

FTP (File Transfer Protocol) enables uploading and downloading files between a client and a server over TCP. It uses separate control (port 21) and data (port 20) channels. FTP transmits usernames, passwords, and file data in plain text, making it vulnerable to network interception. SFTP (port 22) or FTPS are the secure alternatives recommended for all modern deployments.