Fix guides

Close services that shouldn't be public

Some software answers at example.com's address to anyone on the internet: remote desktop, databases, file sharing, admin pages. Automated scanners look for exactly these all day. This guide helps you work out what each one is and shut the ones that don't need to be open.

Who does this
Your IT provider, or whoever manages the server or office network at that address. This one is rarely a do-it-yourself job.
How long
Varies. Closing a service can be minutes; replacing how people reach it takes planning.
Fixes
  • Services that shouldn't be reachable from the internet are visible on this domain
  • Software with publicly known security flaws is running on this domain's servers
  • Some services are reachable from the internet that usually don't need to be

  1. Read the list in your report

    The finding names each service and the port it answers on, for example "Remote Desktop (3389)" or "MySQL (3306)". Forward the report to whoever manages the address; the names and numbers are what they need.

  2. Find the machine behind the address

    Perimeter looks at the addresses example.com points to, which is usually your website's server. If your domain points at your office internet connection instead, the service is on a machine in the office, and the router is forwarding the port to it.

  3. Close what doesn't need to be public

    On a server, restrict the service in its firewall (or the host's control panel) so only your own addresses can reach it. On an office router, remove the port-forwarding rule.

    If people use the service from outside, such as remote desktop for working from home, give them a VPN or your provider's remote access tool instead of opening the service itself to the internet. Databases should almost never be reachable from outside at all.

  4. Update software with known flaws

    If the finding mentions publicly known security flaws, the software on that server is out of date. Update the operating system and whatever the flaw is in: the web server, website software or its plugins. On managed hosting, ask the host. Software that no longer gets updates needs replacing, not patching.

Check it worked

This check reads from a public scan database (Shodan) rather than scanning you directly, and that database can take several days to notice a change. Re-run the checks from the business's report page after a few days; the nightly check will also pick it up.

Your IT provider can confirm straight away by testing the port from outside your network.

The provider's own instructions

Menus move. If a step here doesn't match what you see, these pages are the source of truth.