Open port checker
Enter a host and port to test whether that TCP port is open and accepting connections from the internet.
Common ports: 80 (HTTP), 443 (HTTPS), 22 (SSH), 25 (SMTP), 51820 (WireGuard).
How to use the open port checker
- Enter a host and a port number.
- Press Check.
- See whether that TCP port is open and reachable.
What a port check tells you
An open port means a service is listening and accepting connections from the internet. Closed or filtered means nothing is reachable, often because of a firewall. It's the quick way to confirm a server or self-hosted service (like a WireGuard endpoint on UDP 51820, or a web server on 443) is actually exposed. This checks TCP reachability from our server to the public host you enter.
Code & API examples
Use this from the command line or your code. The API is free, GET-only, and returns JSON.
API (curl)
curl "https://vpn.golf/api/tools/port?host=example.com&port=443"Shell (nc)
nc -zv example.com 443See all endpoints at /api/tools/.
Frequently asked questions
It means a service is listening on that port and accepting connections. A closed or filtered port means nothing is reachable there, often due to a firewall.
To confirm a server or service is reachable, debug firewall rules, or verify a self-hosted app (like a WireGuard endpoint on 51820) is exposed correctly.
Closed means the host replied that nothing is listening; filtered means a firewall silently dropped the probe, so you get no answer. From the outside both look unreachable, but the cause differs.
The service may be bound to localhost only, or a firewall or cloud security group is blocking it. Confirm the app listens on the public interface and that inbound rules allow the port.
This tool tests TCP, where a successful handshake confirms openness. UDP is connectionless and gives no reliable open/closed signal from a simple probe, so WireGuard's UDP port can't be verified this way.
80 and 443 for web, 22 for SSH, 25/465/587 for mail, 3306 for MySQL, and 51820 for WireGuard. Checking these confirms whether the matching service is exposed to the internet.
An open port is only a risk if the service behind it is vulnerable or shouldn't be public. Expose only what you need, keep it patched, and firewall the rest.
It probes from vpn.golf's network, so it reflects what the public internet sees, not your local network. A port open on your LAN can still be closed from outside if NAT or a firewall blocks it.
Allow it in the host firewall (ufw, iptables, or nftables), open it in any cloud security group, and forward it on your router if you're behind NAT. Then confirm the service is actually listening.
Ports under 1024 are assigned to standard services so clients know where to connect by default: 443 for HTTPS, 22 for SSH. You can run a service elsewhere, but clients must then specify the port.
Yes: vpn.golf exposes a free GET-only JSON endpoint at /api/tools/port that returns the open/closed result, handy for monitoring whether a self-hosted service stays reachable.
No. This tool checks one host and port at a time to keep it a diagnostic rather than a scanner. For your own hosts, a local tool like nmap can sweep ranges.
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee for free