- Serve it over HTTPS only and check the HTTP security headers.
- Keep admin consoles and development servers off the Internet.
- Patch the application server and remove default credentials and sample apps.
Web ports
HTTP, HTTPS, application servers, proxies and web admin consoles. 130 ports, most common first.
Securing web services
Other port categories
Remote access /tools/ports/category/remote-access File transfer & sharing /tools/ports/category/file-transfer Email /tools/ports/category/email Databases & caches /tools/ports/category/databases Directory & authentication /tools/ports/category/directory-auth Network services /tools/ports/category/network-services VPN, tunnels & proxies /tools/ports/category/vpn-tunnels Messaging & queues /tools/ports/category/messaging Voice & chat /tools/ports/category/voice-chat Media & streaming /tools/ports/category/media IoT & industrial (ICS) /tools/ports/category/iot-ics DevOps, cloud & containers /tools/ports/category/devops Monitoring & logging /tools/ports/category/monitoring Gaming /tools/ports/category/gaming Other services /tools/ports/category/other