Besides web traffic on 80 and 443, a hosting server listens on a handful of well-known server ports for file transfer, remote login, email, databases and DNS. Knowing what each port does tells you what to open in the firewall, what to restrict, and where to look when a mail client or FTP program cannot connect.
Before you start
- For web ports see web server ports 80, 443, 8080 and 8443.
- For panel ports see cPanel, WHM and Webmail ports.
Quick reference table
| Port | Service | Encrypted? | Open publicly? |
|---|---|---|---|
| 21/TCP | FTP control | Optional (FTPS via AUTH TLS) | Only if you use FTP |
| 22/TCP | SSH and SFTP | Yes | Yes, but restrict or use keys |
| 25/TCP | SMTP server-to-server | STARTTLS | Yes on mail servers |
| 465/TCP | SMTP submission (implicit TLS) | Yes | Yes on mail servers |
| 587/TCP | SMTP submission (STARTTLS) | Yes | Yes on mail servers |
| 993/TCP | IMAPS | Yes | Yes on mail servers |
| 995/TCP | POP3S | Yes | Yes on mail servers |
| 3306/TCP | MySQL / MariaDB | Optional | No, keep private |
| 53/UDP+TCP | DNS | No (plain DNS) | Only on name servers |
Port 21: FTP
FTP uses port 21 for commands and a separate range of passive ports (for example 30000–35000 on cPanel servers) for the actual data. If login works but directory listing hangs, the passive range is blocked. Always use explicit FTPS (FTP with TLS) or, better, SFTP on port 22.
Port 22: SSH and SFTP
SSH gives you a shell; SFTP is file transfer over the same connection, so it needs no extra ports. Port 22 is scanned constantly. Use SSH keys, disable password login, and add Fail2ban or allow it only from your IPs. Moving SSH to another port cuts log noise but is not real security on its own.
Port 25: SMTP between servers
Mail servers deliver to each other on port 25. Clients should not use it to send. Many cloud and VPS networks block outbound 25 to stop spam; see port 25 blocked on a VPS.
Ports 465 and 587: sending mail from apps and clients
Both are submission ports that require authentication. 465 starts encrypted from the first byte (implicit TLS); 587 starts in plain text and upgrades with STARTTLS. Either is fine; current standards prefer 465. Use one of these in Outlook, Thunderbird, phones and WordPress SMTP plugins.
Ports 993 and 995: reading mail
993 is IMAP over TLS (mail stays on the server and syncs across devices). 995 is POP3 over TLS (mail is downloaded, usually to one device). The unencrypted versions, 143 and 110, should not be used across the internet. Settings for MdmHost mailboxes are in cPanel email ports.
Port 3306: MySQL and MariaDB
Websites on the same server connect to the database through localhost or a Unix socket, so 3306 does not need to be public at all. If a remote app must connect, allow only that IP in the firewall and in the database user's host. An open 3306 invites password guessing and data theft.
Port 53: DNS
DNS answers on UDP 53 for normal queries and TCP 53 for large answers and zone transfers. Open it only on servers that are authoritative name servers. Never run an open recursive resolver on a public IP; it gets abused for amplification attacks.
Check what is listening
sudo ss -tulpnAnything listening on 0.0.0.0 or [::] is reachable from every network unless the firewall blocks it. Services that should be private should listen on 127.0.0.1.
FAQ about server ports
Which ports should a basic web VPS expose?
22, 80 and 443 (plus UDP 443 for HTTP/3). Add mail, FTP or DNS ports only if you run those services.
Should I use 465 or 587?
Either works. Use whatever your client or host recommends; both encrypt the session.
Why can my mail client receive but not send?
Usually the outgoing port is blocked by your ISP or you used 25. Switch to 465 or 587 with authentication.