How to Check if Your Server Is Exposed to the Internet in Under an Hour

Twelve thousand Zimbra servers were reachable from the internet last week and more than 270 of them were already compromised. Every one of those was findable in about ten minutes by the people who own them. Knowing how to check if your server is exposed to the internet is the highest-leverage hour anyone running self-hosted services can spend, and it does not require buying anything.

Step 1: Find your actual public IP

Run curl ifconfig.me from the machine in question. On a home connection this is your router's WAN address, which may change. On a VPS it is the address the whole internet already knows. Write it down, because every following step points at it.

Step 2: Scan yourself from outside your own network

This is the step people get wrong. Scanning from inside your LAN tells you what is listening locally, not what is reachable from outside. Use a phone on mobile data, a cheap VPS, or an online port scanner. What you want is the list of ports that answer from the public internet.

Anything that answers and that you did not deliberately publish is a finding.

Step 3: Audit what UPnP has opened

UPnP lets applications ask your router to forward ports without telling you. Games, media servers and torrent clients all do it. Log into the router, find the port forwarding or UPnP table, and read it. Entries you cannot explain should be deleted, and UPnP itself should usually be off.

Step 4: Decide what genuinely needs to be reachable

For most homelabs the honest answer is nothing, or one thing. A remote game server, maybe. Media libraries, dashboards, network storage, management interfaces and databases almost never need a public port. Anything on that list stays private.

Step 5: Put the rest behind a VPN or authenticated proxy

A WireGuard or Tailscale mesh gets you back into your own network without exposing individual services. Where something must be public, a reverse proxy with real authentication in front of it is the minimum. Never expose an admin interface directly, and never rely on a non-standard port as security, because scanners check all of them.

Step 6: Turn on automatic security updates

The Zimbra and NetScaler flaws currently under attack both had patches available for over a month before exploitation started. Automatic security updates close that window without you doing anything, which is the point. Full detail on those two is in our piece on Zimbra CVE-2026-73570 and the servers still exposed.

Step 7: Set a monthly reminder

Your exposure changes on its own. You add a container, reset a router, restore a config from backup, and something opens without you noticing. A calendar reminder to redo steps two and three costs ten minutes a month.

Kit that helps, if you are starting from nothing

A Raspberry Pi 5 is enough to run a VPN gateway and a reverse proxy for a household, and it costs less than a year of most VPS plans. A hardware security key such as the YubiKey 5 NFC covers the authentication side for anything you do choose to publish. If you are weighing local storage against paying someone else, our five-year cost comparison of NAS against cloud storage has the numbers, and the Android security checklist covers the devices connecting in.

The scan is the part that matters. Everything else is optional.

Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.