Endpoint Monitoring
Every Open Port, Judged Against What You Approved
Once a day the platform scans all 65,535 TCP ports on each endpoint (a server or IP address), from the outside. Nothing is installed on the server.
Plans from $19 a month • Firewall map included
What the Scan Finds
Nothing is allowed by default. Every port and service that answers is checked against your own Allowed Ports list: green means open on purpose, red means open and nobody approved it. Even 80 and 443 raise a Low issue until you add them to the list.
How a Port's Severity Is Decided
Severity starts from what the port is.
- CriticalDatabase, remote desktop and legacy file-sharing ports (MySQL, PostgreSQL, Redis, RDP, VNC, SMB)
- HighSSH, FTP, the mail ports, 8080 and 8443
- MediumCommon development ports, and any port the scan doesn't recognize
- Low80 and 443
A known vulnerability or an end-of-life banner raises a finding to High or Critical.
How Endpoint Monitoring Works
Every check runs automatically, to a schedule, on the platform's own infrastructure. The platform finds the exposure, grades it and delivers the alert. You close the port.
1. Scanned From the Outside
Scans run from the platform's own infrastructure against your server's public address, read-only, with no agent on the server.
2. A Full Sweep Every Day
All 65,535 TCP ports on every active endpoint, once a day, with a lighter pass every 5 to 30 minutes in between.
3. Allowed Ports
A rule approves one port or a range, on one endpoint or the whole account, with a written reason and an optional expiry date.
4. Alerts With the Fix Attached
Each alert gives the severity, the port, what it means in plain language, and copy-and-paste fix commands for UFW, iptables, AWS, GCP or Azure.
5. Issues That Close Themselves
Close the port and the issue resolves itself once the port has stayed shut for 36 hours.
6. Scan History and Issue Timelines
Every endpoint keeps its scan history, and every issue keeps a timeline of detections, acknowledgments, closures and reopens.
How an Alert Reaches You
By email and in the portal, and in Slack once you connect it.
Deal With It Without Logging In
Every alert email carries signed one-click links, so you don't have to log in first.
- Act from the email. View the issue, acknowledge it or add the port to Allowed Ports. Links last up to 24 hours, and the Slack message has the same buttons.
- No flood. At most one email every 60 minutes for the same endpoint and port. Critical ports such as 3306 and 3389 skip that limit.
- Your pace. Immediate alerts, or an hourly, daily or weekly digest.
Port 8080 answering on the public address · Not allowed
Close the port or restrict it to a trusted address.
Reselling it? Your customers get the same alerts under your brand, and in your WHMCS client area if you run the module. See the White Label page
The Firewall Map
A map of what the internet can reach and which of your servers can reach which, drawn from your own firewall rules and cross-checked against the scan and your Allowed Ports. It comes with endpoint monitoring at no separate price.
A Server Can Look Locked Down and Still Answer
Docker is the common case: it publishes ports through its own rules and bypasses UFW.
Where the rules come from
- A small script on each server reads the active firewall (UFW, firewalld, nftables or iptables).
- It posts the output over HTTPS with an API key, every six hours by default.
- It opens nothing, listens on nothing and changes nothing.
- Rules can be pasted in by hand instead.
Ungrouped · 2
What Your Tech Team Will Ask
Gentle on the Server
The deep scan is a standard SYN scan with a hard ceiling of 500 packets per second and a 15-minute cap per host, so a server sees a trickle of traffic and a scan cannot run away.
What Counts as an Endpoint
One IP address, or one hostname that resolves, re-resolved every hour. A range in CIDR notation is not accepted: each address is its own endpoint, and it is not a place where software is installed.
When a Service Is Canceled or Downgraded
Nothing is deleted. When a WHMCS service is suspended, canceled or changed, paid capacity is recalculated, and if the account is over it the newest resources are paused first. The oldest resume when capacity returns.
What It Costs
For your own servers, endpoint monitoring is a monthly plan, with dark web monitoring for your domains included.
Starter
$19 a month
Up to 10 endpoints
1 domain included
Professional
$49 a month
Up to 50 endpoints
5 domains included
Business
$179 a month
Up to 250 endpoints
15 domains included
Resellers pay $1.50 per endpoint per month, wholesale.
Frequently Asked Questions
How often are servers scanned?
Once a day for the full sweep of all 65,535 ports. Between sweeps, a lighter pass runs every 5 to 30 minutes, by plan, over a rotating tenth of the range plus every port known to be open, and any change is verified with a deep scan. You can also trigger a scan with Scan Now, once per endpoint per hour.
What about ports that are supposed to be open?
They go on your own Allowed Ports list, and while the rule stands they raise no issue at all. The port still appears in scan history, marked as allowed rather than exposed. A rule can apply to one endpoint or to every endpoint on your account. Each rule covers one port or a range, for one protocol, and it closes any matching open issue straight away.
What happens after I close an exposed port?
Nothing by hand, and nothing instant either. Full scans run nightly and the issue only clears once the port has stayed shut through the 36-hour grace period, so expect a day or two. Scan Now does not shorten that wait. If the port comes back within 30 days, the original issue reopens instead of a duplicate. If you prefer, you can acknowledge and resolve an issue yourself, which schedules a follow-up scan.
Where can I see past scans?
Every endpoint has a Scan History tab with the 25 most recent scans and what changed since the one before. The full history downloads as a CSV.
How is the severity of an exposed port decided?
By what the port is, and then by what the scan finds answering on it. The full ladder is under What the Scan Finds, above: four fixed labels, with an unrecognized port defaulting to Medium and a known vulnerability or an end-of-life banner raising a finding to High or Critical.
Will the scan slow down my server?
No. The scan is capped at 500 packets per second and 15 minutes per host, and it cannot exceed either limit. It never opens a session: it notes what answers on a port and stops there.
What can I add as an endpoint?
An IP address, or a hostname; a hostname that does not resolve is refused at the point it is added. Because the lookup repeats hourly, a server that changes address carries on being monitored and the change is written to the endpoint.
Can I acknowledge or clear an issue from the email?
Yes, from the email or the Slack message, without logging in: the buttons are signed links that stop working after 24 hours. An issue is acknowledged when someone has seen it and resolved when it has been dealt with, and each step lands on its timeline. There is no snooze or mute.
Start With One Endpoint
Plans from $19 a month for your own servers, or $1.50 per endpoint wholesale when you resell it.
Start MonitoringOr create a partner account to resell it