Port reference
Port 9000 (TCP) – PHP-FPM / SonarQube
Shared port for PHP-FPM FastCGI, the SonarQube web UI, and assorted development HTTP servers.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open when PHP-FPM, SonarQube, or a dev server runs. PHP-FPM is meant for localhost only; exposing the FastCGI socket is dangerous.
What is port 9000 used for?
Port 9000 is shared by several popular tools, so the answer depends on what you run. Most commonly it is the FastCGI socket for PHP-FPM, which a web server like Nginx connects to behind the scenes to run PHP. It is also the default for the SonarQube code-quality dashboard and a frequent pick for development HTTP servers and tools like Portainer or MinIO. Always confirm which service is actually listening.
When would you open it?
Open or forward 9000 only if you are deliberately running a service on it and need to reach it. PHP-FPM is normally kept on localhost and talked to by your local web server, so it rarely needs to be opened at all. For something like SonarQube you would expose it on a trusted network or behind a reverse proxy.
Is it safe to open?
Most services on 9000 (especially PHP-FPM) have no authentication and were never meant to face the internet, so exposing it can let strangers run code or read data. Keep it on localhost or a private network and put any web UI behind authentication. See the security notes below.
How to check if this port is open
ss -tulpn | grep :9000
nmap -p 9000 <target>netstat -ano | findstr :9000
Test-NetConnection <host> -Port 9000lsof -i :9000
nmap -p 9000 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 9000 to your device's local IP, internal port 9000, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 9000/tcpsudo firewall-cmd --permanent --add-port=9000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9000 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 9000" -Direction Inbound -Protocol TCP -LocalPort 9000 -Action AllowSecurity & risks
Common attacks
- Remote code execution via an exposed PHP-FPM FastCGI socket
- Direct FastCGI requests bypassing the web server to run PHP
- Unauthenticated SonarQube dashboards leaking source and tokens
- Scanning dev HTTP servers for debug endpoints and secrets
Hardening
- Bind PHP-FPM to a Unix socket or 127.0.0.1, never to a public interface
- Never expose the FastCGI port to the internet
- Authenticate SonarQube and change default admin credentials
- Firewall 9000 to localhost/trusted hosts and patch the service
- Disable or lock down dev servers in production
How to block this port
sudo ufw deny 9000/tcpsudo firewall-cmd --permanent --remove-port=9000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9000 -j DROPNew-NetFirewallRule -DisplayName "Block 9000" -Direction Inbound -Protocol TCP -LocalPort 9000 -Action Blocknmap snippet
nmap -p9000 --script http-title,fcgi,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What runs on port 9000?
- Port 9000 is ambiguous. It is the default for PHP-FPM's FastCGI socket, the SonarQube web UI, and many development HTTP servers. Identify the actual service before assessing risk.
- Why is exposing PHP-FPM on 9000 dangerous?
- PHP-FPM speaks FastCGI with no authentication. If 9000 is reachable, an attacker can send crafted FastCGI requests to execute arbitrary PHP and gain RCE. Bind it to localhost or a Unix socket and firewall the port.