Skip to content
ProtocolPorts

Port reference

Port 9090 (TCP) – Prometheus

Prometheus monitoring server web UI, HTTP API, and query interface; also a generic web-admin port.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open when Prometheus runs. By default it ships with no authentication, so anyone reaching 9090 can query metrics and reach admin endpoints.

What is port 9090 used for?

Port 9090 is the default for Prometheus, the popular open-source monitoring and metrics server. It serves the web UI, the HTTP API, and the PromQL query interface you use to explore metrics, targets, and alerting rules. Prometheus is usually paired with Grafana for dashboards, though Grafana itself runs on 3000. The same port number is also reused by a few other web-admin tools, but Prometheus is by far the most common occupant.

When would you open it?

Open or forward 9090 when you need to reach the Prometheus UI or API from another machine, for example to view metrics or let Grafana query it across hosts. In most setups you keep it on an internal network or behind a reverse proxy rather than opening it to the public internet.

Is it safe to open?

Prometheus has no built-in authentication, so anyone who reaches 9090 can read metrics that map out your infrastructure. Keep it on a private network and put it behind an authenticating reverse proxy if remote access is needed. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :9090
nmap -p 9090 <target>
Windows
netstat -ano | findstr :9090
Test-NetConnection <host> -Port 9090
macOS
lsof -i :9090
nmap -p 9090 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 9090 to your device's local IP, internal port 9090, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 9090/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=9090/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 9090 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 9090" -Direction Inbound -Protocol TCP -LocalPort 9090 -Action Allow

Security & risks

Common attacks

  • Unauthenticated access to metrics revealing internal topology
  • SSRF and config abuse via scrape targets and the API
  • Internal recon from labels, targets, and service discovery data
  • Admin API abuse (e.g. snapshot, lifecycle) when enabled

Hardening

  • Never expose 9090 to the internet; bind to localhost or an internal VLAN
  • Put Prometheus behind an authenticating TLS reverse proxy
  • Disable the admin API unless required (--web.enable-admin-api)
  • Restrict scrape configs and validate targets to limit SSRF
  • IP-allowlist access and keep Prometheus patched

How to block this port

Linux (ufw)
sudo ufw deny 9090/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=9090/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 9090 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 9090" -Direction Inbound -Protocol TCP -LocalPort 9090 -Action Block

nmap snippet

nmap -p9090 --script http-title,http-headers <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 9100Port 3000Port 8080Port 9093

Frequently asked questions

What is port 9090 used for?
It runs the Prometheus monitoring server's web UI, HTTP API, and PromQL query interface. It is also used by various web-admin tools. Prometheus ships with no built-in authentication by default.
Is it safe to expose Prometheus on 9090?
No. With no authentication by default, anyone reaching 9090 can query metrics that map your internal infrastructure and abuse scrape targets for SSRF. Bind it internally and front it with an authenticating reverse proxy.

Browse by category

Web & HTTP ports

Related guides