VNC remote screen (port 5900) is open

In short: VNC remote screen control should not face the internet.

What to do

1. Remove any router port forward to port 5900 (see below).
2. If you use VNC, switch to a VPN into your home network first, then connect through it.
3. Set a strong password on the VNC software, or uninstall it if you do not use it.

Check your router first

1. Open your router's settings page (addresses are listed below).
2. Look for Port Forwarding (also called Virtual Server or NAT). Delete any rule you did not create on purpose.
3. Look for Remote Management or Web Access from WAN and turn it off.
4. Look for UPnP. Turning it off stops devices from opening ports on their own. A few games and apps may need it, so turn it back on only if something stops working.
5. Save, then run the check again.

Where to look on common routers

Menu names change between models and firmware versions. If yours does not match, search the menus for the setting name, or look up your model number on the maker's support site.

• Netgear: sign in at routerlogin.net. Look under Advanced, then Advanced Setup (or Administration) for Remote Management, Port Forwarding and UPnP.
• TP-Link: sign in at tplinkwifi.net. Look under Advanced, System, Administration for Remote Management, and under NAT Forwarding for Port Forwarding and UPnP.
• ASUS: sign in at router.asus.com. Administration, System has Enable Web Access from WAN (set to No). WAN, Virtual Server / Port Forwarding lists forwards.
• Linksys: sign in at 192.168.1.1 or myrouter.local. Look under Security or Administration for Remote Management, and for port forwarding under Security or Apps.
• Google Nest Wifi, eero: managed in the phone app. Look for port management or UPnP in the network or advanced settings. These do not normally expose a remote admin page.
• Internet provider's modem or gateway: sign in with the address and password on its label, or use your provider's app. If you cannot find the setting, call your provider and ask them to turn off remote management and any port forwards you did not set up.