What a home network check can and cannot see

What the website check does

When you press the button, our server tries to open a connection to your internet address on a short list of 12 common ports. For each one it waits up to two seconds. If something answers, that port is "open" and appears in your result. If nothing answers, it is treated as closed. That is all it does. It does not try passwords, does not read what a device says back, and does not change anything.

The 12 ports are common doors that are risky when left open on a home connection: Telnet (23), file sharing (445), Remote Desktop (3389), VNC screen control (5900), MikroTik router admin (8291), your internet company's router management (7547), FTP (21), SSH remote login (22), and web pages on 80, 443, 8080 and 8443. If your connection has both an IPv4 and an IPv6 address, the page checks each.

It can only look at the address you are visiting from. You cannot type in someone else's address, and each connection can run the check three times an hour.

What it cannot see

• Anything inside your home. TVs, phones, printers and cameras on your Wi-Fi are behind your router, so the check never sees them. The free Home Scan app looks at those from inside your network, only when you run it.
• Whether anything is up to date. A router with an old, flawed program can still show every door closed.
• Passwords. It cannot tell whether your Wi-Fi password or your router admin password is strong.
• Doors not on the list. Twelve ports is a short list on purpose. A different port, or a service that does not use a plain connection, will not show up.
• Cloud-connected gadgets. Many cameras and doorbells connect out to a company's servers instead of opening a door at your home. They will not appear, and their safety depends on the company and your account password.
• Email, accounts and scams. It says nothing about whether a password has leaked or whether a message is a scam.

Reading your result

• A clear result (A) means none of the 12 doors answered. That is good news about the front door. It is not a promise that you are safe.
• Anything open keeps you out of the A range. The most serious findings, such as Remote Desktop or Telnet, cap the grade at F no matter what else is clear. Serious ones, such as SSH or FTP, cap it at C, and a web page caps it at B.
• Open does not always mean wrong. Port 7547 is often your internet company's normal remote management. SSH or a web page may be something you set up on purpose. Each finding links to a guide that says how likely it is to matter and how to check.
• Closed can mean "hidden", not "protected". A router firewall that stays silent is doing its job for those doors, but it says nothing about the devices behind it.

Common ways to get a misleading result

• You were on a VPN or a phone hotspot. The check looks at the address you appear to come from, so it checked the VPN or the mobile carrier, not your home. Turn the VPN off and use your home Wi-Fi.
• You were at a different location. At work, a hotel or a friend's house, it checked that network.
• The result changed later. Gadgets and routers can open doors on their own, for example with UPnP. A clear result today does not cover next month.

A reasonable routine

Run the check after you change router settings, after you add a camera or storage box, and once or twice a year. If something shows up, follow its guide. For the inside of your network, run the Home Scan app. To see why these doors matter, read why check your home network. If you would rather have someone look at your report with you, see the support page.