Security & SEO

    Open port scan check

    Weekly scan of the top 20 attack-surface ports (SSH, RDP, MySQL, Redis, MongoDB…) so a forgotten firewall rule cannot silently expose your DB.

    Updated 2026-07-10
    1 min read
    ports
    firewall
    attack-surface

    Quick answer#

    Lemwatch runs a lightweight TCP SYN probe against 20 high-risk ports weekly. New unexpected opens raise severity: high.

    What it checks#

  1. SSH (22), RDP (3389), Telnet (23)
  2. MySQL (3306), Postgres (5432), Redis (6379), MongoDB (27017), Memcached (11211), Elasticsearch (9200)
  3. FTP (21), SMB (445)
  4. Common admin panels (8080, 8443, 10000)

    5. Where to find it in Lemwatch#

    Site details → Security → Ports.

    How to respond#

  5. Confirm whether the port is intentionally open.
  6. If not, close it at the cloud firewall or security group.
  7. If required (SSH), restrict source IPs and enable key-only auth.
  8. Acknowledge to baseline the new state.

    9. FAQ#

    Is this an intrusive scan?#

    No — single SYN packet per port, no exploit attempts, throttled to be invisible to standard IDSes.

    Do you scan all 65k ports?#

    No — only curated high-risk ports. A full scan would trigger AUP violations on most clouds.

    Related#

  9. Bypassing bot protection
  10. Lemwatch IP whitelisting
  11. Fixing 5xx errors from firewall
    12. Was this article helpful?

    Previous

    Blacklist & reputation check

    Next

    HSTS header check

    Related Articles

    Bypassing bot protection for Lemwatch checks

    Configure bot-management platforms (Cloudflare, DataDome, PerimeterX, Akamai) so Lemwatch checks succeed without weakening security.

    Whitelist Lemwatch monitoring IPs

    Allow Lemwatch checks through your firewall, WAF, or rate limiter using our published IP ranges and User-Agent.

    Fixing 5xx errors caused by your firewall

    Diagnose 502, 503, and 520 responses that only appear in Lemwatch — usually WAF rate limits or origin timeouts.

    Mobile-friendly check

    Emulates a Moto G4 to detect tap targets <44px, unreadable font sizes, horizontal scroll, and missing viewport meta — the mobile-first indexing killers.

    Back to Help Center