An open port is not a vulnerability. It is a service reachable from the internet. Whether that is a problem depends entirely on whether you meant it.
Most of what a port scan turns up is not exotic: a database that should only ever have been reachable from the application server, a management interface someone opened for an afternoon in 2021, a remote-access service left listening after a migration.
Why this one needs proven ownership
The port scan is an active check. It connects to a host and asks what is there. That is a different act from reading a DNS record, so the asset must be proven yours first — a DNS TXT record, a file at /.well-known/, a code emailed to an address at the domain, a callback from the IP, or reverse DNS.
It costs four credits; the full-range tier costs eight.
What each tier does
The standard scan covers the ports services are traditionally assigned to — the ones that carry the overwhelming majority of real exposure.
The full-range tier sweeps all 65,535, and does something the standard tier does not: it asks each open port what it is actually running, rather than reading the answer off the port number. That matters because the convention is only a convention. An administrator who moved SSH to 2222 did not hide it; they only moved it somewhere a lazy scan will not look and a service-detection scan will find immediately.
What an attacker already knows
Both tiers also report what a public internet-wide index already publishes about the same addresses.
This is worth dwelling on. Several projects continuously scan the entire internet and publish what answers. Anyone can query them. So before an attacker sends your infrastructure a single packet, they can already have a list of your open ports, the software versions answering, and often the certificates in use — for free, with nothing in your logs.
Seeing that alongside what ClickScan tested itself tells you what you are already advertising.
And it never moves your grade. A third party's observation is shown because it is what an attacker learns for free, and it is counted separately from your own findings. Your grade reflects only what ClickScan proved by testing.
Scanning is bounded on purpose
Scanners never connect to private or reserved address ranges. Concurrency is limited by default to two simultaneous scans against the same host, and operators who want their ranges excluded can ask at [email protected]. A scanner that hammers a host to produce a faster report is a scanner that gets its findings from an outage.
What you get
Which ports answer, what is on them, and a grade from A+ to F. Run it on a schedule and change detection tells you when something new starts listening — which is usually the first sign that a deployment did something nobody intended.
Every new account gets free starter credits. Start at app.clickscan.ai, or see everything ClickScan checks.