whatportis.com
suggest an edit →

Port 9090Openfire Admin Console

**Openfire Administration Console** is a web interface used to configure, manage, and monitor the Openfire real-time collaboration server, which supports XMPP messaging. It enables administrators to easily perform server maintenance, user management, plugin control, and monitor server statistics using an intuitive graphical interface typically accessed via a web browser..

inWeb ServicesVoice and Chat
transport
tcp

single transport

in transit
cleartext

payload readable on path

assignment
unofficial

used by convention

risk
4/10

caution

lookups
34,244

rank 30 of 993 · top 3%

2 other services are registered on port 9090. compare all 3 →

Technical Details

what runs on :9090

Openfire is an open-source XMPP (Jabber) server widely used for facilitating real-time communication within organizations. Its Administration Console is the centralized, browser-based portal provided on port 9090 (HTTP, unencrypted by default), allowing system administrators to configure the server’s messaging capabilities, user rosters, security settings, plugins, and real-time monitoring tools.

The console leverages standard web technologies, providing intuitive navigation to modify server settings and manage connected users and groups. It can handle integration with databases, LDAP directories, and various authentication services. Administrators can deploy plugins directly from the console to extend server functionality, such as adding archiving, gateways to external IM services, or additional real-time features.

By default, the console runs unencrypted over HTTP, but it is configurable to run over HTTPS (typically on port 9091) to secure management traffic. The console’s accessibility and control capabilities make it essential for ongoing Openfire server administration but also warrant careful security considerations.

Security Information

exposure of :9090

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

web services averages 3.9 across 112 ports — this one sits 0.1 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

Common Vulnerabilities:

  • Unencrypted HTTP: If left in default unencrypted mode, console credentials and session data can be intercepted via man-in-the-middle attacks.
  • Weak authentication policies: Openfire may be susceptible if strong passwords or additional authentication mechanisms are not enforced.
  • Exposure to internet: If the console is accessible publicly, it can be targeted in brute force, credential stuffing, or exploitation of known vulnerabilities.
  • Outdated software/plugins: Running outdated versions may expose known security flaws.

Common Mitigations:

  • Restrict console access to trusted IPs or internal networks via firewall rules.
  • Enable HTTPS by configuring SSL certificates to encrypt management sessions.
  • Enforce strong password policies and consider multi-factor authentication if possible.
  • Regularly update Openfire and installed plugins to mitigate known vulnerabilities.
  • Disable or limit management console exposure on non-essential interfaces and monitor login attempts for anomalies.

Related Ports

all 112 in web services →

the 8 most looked-up other ports in web services — 112 ports carry that label.

portservicerisk
:8888Sun Answerbook & Alt HTTPcaution
:8000Intel Remote Desktop / Alternate HTTP Portsafe
:8888NewsEDGEcaution
:8888HTTP Alternative Portcaution
:8888GNUmp3d Streaming HTTPcaution
:9080Groove RPCcaution
:8881Atlasz Secure Servercaution
:80HTTPcaution

risk mix of the 8 listed

  • safe13%
  • caution88%

0 of 8 encrypted