Run a full external port scan and close unnecessary open ports

A full external port scan identifies which network ports on your server are actually accessible from the outside internet, providing genuine, direct visibility into your actual network-level attack surface — every open port represents a potential access point, and unnecessary open ports represent unnecessary risk with no corresponding legitimate benefit.

This scanning approach complements the more application-level security checks discussed throughout much of this broader security work by specifically examining network-level exposure — even a well-secured web application can carry genuine risk if unnecessary network services remain accessible from the outside internet, representing a distinct attack surface from web-application-specific vulnerabilities.

The genuine principle here mirrors what's discussed regarding unused admin accounts and plugins elsewhere — every open port should serve a genuine, actively required function, and any port open without clear, current legitimate purpose represents unnecessary risk that closing entirely eliminates, following the broader security principle of minimizing available attack surface wherever genuinely possible.

Interpreting scan results requires genuine understanding of what's actually necessary for your legitimate infrastructure — some open ports serve genuinely required functions like standard web traffic, while others might represent forgotten or unnecessary services that should be closed — this distinction sometimes benefits from technical expertise to properly evaluate your specific scan results against your actual infrastructure's genuine requirements.