Port reference
Port 7474 (TCP) – Neo4j HTTP / Browser
Default port for the Neo4j HTTP API and the web-based Neo4j Browser interface.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Neo4j ships with a default neo4j/neo4j login that must be changed on first use, but exposed instances on 0.0.0.0:7474 with weak or default credentials remain common.
What is port 7474 used for?
Port 7474 is the default port for the Neo4j HTTP API and the web-based Neo4j Browser, the tool used to run Cypher queries and administer a Neo4j graph database. Developers open it in a browser to explore data, build queries, and manage the database. Neo4j's high-performance Bolt protocol uses port 7687, and HTTPS uses 7473.
When would you open it?
Open 7474 when you run Neo4j and want to reach the Browser interface from another machine on your network. For anything beyond local development, it is better to keep it private and connect through a VPN or a reverse proxy rather than exposing it directly.
Is it safe to open?
Neo4j ships with a default neo4j/neo4j login and the Browser gives full query access to your data, so always set a strong password and keep the port off the public internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :7474
nmap -p 7474 <target>netstat -ano | findstr :7474
Test-NetConnection <host> -Port 7474lsof -i :7474
nmap -p 7474 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 7474 to your device's local IP, internal port 7474, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 7474/tcpsudo firewall-cmd --permanent --add-port=7474/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7474 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 7474" -Direction Inbound -Protocol TCP -LocalPort 7474 -Action AllowSecurity & risks
Common attacks
- Login with the default neo4j/neo4j credentials
- Unauthenticated or weak-auth access to the Browser and HTTP API
- Cypher injection from exposed application layers
- Information disclosure of graph data via the HTTP query endpoint
Hardening
- Change the default neo4j password immediately; enforce strong credentials
- Bind to localhost or a private interface; never expose 7474 to the internet
- Require TLS (prefer HTTPS on 7473) and restrict the Bolt port (7687)
- Firewall 7474 to trusted hosts and put a reverse proxy in front if remote
- Keep Neo4j patched and audit access
How to block this port
sudo ufw deny 7474/tcpsudo firewall-cmd --permanent --remove-port=7474/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7474 -j DROPNew-NetFirewallRule -DisplayName "Block 7474" -Direction Inbound -Protocol TCP -LocalPort 7474 -Action Blocknmap snippet
nmap -p7474 --script http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the default Neo4j login?
- Neo4j ships with neo4j/neo4j and prompts for a password change on first login, but many exposed instances keep weak or default credentials. Always set a strong password before exposing 7474 or the Bolt port 7687.
- Is it safe to expose the Neo4j Browser on port 7474?
- No. The Browser and HTTP API allow running Cypher queries against your graph. Bind to a private interface, require TLS, change default credentials, and firewall 7474 to trusted hosts.