Terms of Service

Using whatportis.com — reading a page, running a search, calling the API, or sending a correction — means you accept these terms. If you don't accept them, don't use the site. There's no box to tick and nothing to sign; using it is the agreement.

If you're using WhatPortIs as part of your job, you accept these terms on behalf of the organisation you work for as well as yourself. If you're under the age at which you can agree to a contract where you live, use the site with a parent or guardian who can.

These terms sit alongside the privacy policy and the cookie policy, which explain what the site does and doesn't collect.

WhatPortIs is a community-maintained reference: what normally listens on a port, whether that traffic is encrypted by default, how exposed it tends to leave you, and which RFCs and vendor documents back the entry up. Some entries follow the IANA service name and port number registry. Many don't — they cover software that claimed a port in practice and never registered it.

That means the database describes what is generally true of a port, not what is true of your network. The site has no idea what's actually running on port 8080 on your machine, and never claims to.

Everything public here is free. There is nothing to buy, no subscription, no advertising and no paid tier, so there are no billing, renewal or refund terms to read.

There are also no public user accounts. You don't sign up to browse, search, use the API or send a correction. The only login on the site is the maintainers' admin area, which isn't open to the public; attempting to reach it isn't a login failure, it's a breach of these terms.

Because nothing is paid for, nothing is promised in the way a paid service promises it. The site may be slow, briefly down, or occasionally missing a feature it had last week.

The JSON API is public, read-only and unauthenticated. There is no key, no signup, and — as the code stands today — no rate limiter enforcing a request budget. That is a courtesy, not a guarantee, and it only works while nobody abuses it.

So: cache what you fetch. Responses ship with cache headers; honour them, pull the registry once rather than once per page view, and back off when you get an error instead of retrying in a tight loop. If your usage starts costing more than it's worth, the reasonable response is to slow down before you're asked to.

The API may change. Endpoints, response shapes and defaults can be added, altered or withdrawn, rate limits or keys may be introduced if the traffic makes them necessary, and the whole thing may be taken down. Nothing here is a service-level commitment, and building something whose uptime depends on this API is your risk to take.

Anyone can submit a new port or suggest an edit to an existing entry, with no account. The forms ask for the port data — service, transport, description, risk, references, known vulnerabilities — plus your name and email, and, on an edit, a reason for the change. Accepted contributions are published publicly: on the site, in the database and through the JSON API, where anyone may copy them.

Submitting is therefore a licence, and here is exactly what it covers.

Nobody owns the underlying facts. Port 443 carries HTTPS whether or not this site exists; port numbers, protocol names, IANA assignments and CVE identifiers are facts and public record, and you may use them freely and without attribution. WhatPortIs makes no copyright claim over them and would be wrong to.

What the site does own is the work around them: the selection and arrangement of entries, the written descriptions and security notes, the risk scoring, the category scheme, the site design and the source code. Those are protected, and republishing the database wholesale as your own compilation isn't covered by “facts are free”.

In practice: take the data and build things with it, including commercially. A link back to whatportis.com where it fits is appreciated and not required. If you want to mirror the whole database or redistribute it under your own brand, ask first at [email protected].

The WhatPortIs name and logo aren't part of that permission. Don't use them in a way that suggests the site endorses or produced your product.

Entries cite RFCs, vendor documentation, advisories and other outside sources. Those pages belong to whoever publishes them. WhatPortIs doesn't control them, doesn't vouch for them, and can't promise a link still resolves or still says what it said when the entry was written — an RFC gets obsoleted, a vendor moves a doc, an advisory is revised.

A citation is a pointer, not an endorsement, and it doesn't mean the cited party endorses this site. Once you follow a link you are on someone else's site, under their terms and their privacy policy. Where an entry and its source disagree, trust the source and tell us.

To the fullest extent the law allows, WhatPortIs and the people who run it are not liable for any loss or damage arising from your use of the site or the data — including lost profit, lost data, business interruption, a security incident, or anything that follows from an entry being wrong, incomplete or out of date. That applies whether the claim is in contract, negligence or anything else, and whether or not the possibility was flagged in advance.

The site is free, so there is no fee to refund and total liability for any claim is capped accordingly — at zero, or at the smallest sum the law will permit if it won't permit zero.

Some jurisdictions don't allow certain exclusions, particularly for death or personal injury caused by negligence, or for fraud. Nothing here excludes liability that can't lawfully be excluded, and where a limit is unenforceable it applies as far as it can and no further.

The site changes constantly: entries are corrected, categories are reorganised, risk scores are revised, pages and API fields come and go. Any part of the service may be modified or discontinued without notice, and nothing on the site is guaranteed to be there tomorrow.

These terms can change too. The current version always lives at this URL with its date at the top; the date is how you tell whether anything moved. Material changes will be flagged on the site where it's practical to do so. Continuing to use WhatPortIs after a change means you accept the updated terms — and since there are no accounts, there is no other way to notify you.

There is no account to suspend, so enforcement is blunt: traffic that breaks the rules above can be rate-limited, blocked at the network or application layer, or refused outright, without notice. Submissions from a source that spams or vandalises the database can be ignored wholesale, and content already published can be removed or corrected at any time.

Serious abuse — attacks on the site, or use of the data to attack others — may be reported to a hosting provider, a network operator or the relevant authorities. If you think you've been blocked by mistake, say so at [email protected] and it'll be looked at.

These terms are governed by the laws of [jurisdiction to be completed by the site operator], and the courts of [jurisdiction to be completed by the site operator] have exclusive jurisdiction over any dispute arising from them or from your use of the site.

If you're a consumer, this doesn't take away rights you have under the mandatory law of the country you live in, including the right to bring a claim in your local courts. If any clause in these terms turns out to be unenforceable, the rest still stands.