Port Forwarding Safety Rules Open Only Ports 80 and 443
Port forwarding does not know friends from strangers. The moment a port opens, automated scanners find it - typically within minutes - and start knocking with password lists, forever. These are the rules that let you host a website from home without quietly hosting everyone else too.
✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 7 minute read
🎥 Watch the video to see forwarding set up for the website - this guide is the safety discipline around it
The hosting setup in the video asks you to forward ports, and for a website that is the right move. What separates a safe home server from a future incident report is not the forwarding itself - it is how short the door list is and how well the rooms behind the doors are kept. This guide is that discipline, written plainly enough to tape to the router.
The door list of a home web server
Port 80 - HTTPForward to the web PC OPEN
Port 443 - HTTPSForward to the web PC OPEN
Port 3389 - Remote DesktopMost attacked service online NEVER
Router admin pageKeys to the whole network NEVER
Port 445 - File sharingA worm's favourite door NEVER
1
The Rule of Two Doors
A website needs exactly two doors: 80 for HTTP and 443 for HTTPS, both forwarded to the one PC that runs the site. That is the whole list. Every additional forwarded port must justify itself in a sentence you could say out loud - what service, for whom, and why it cannot be reached any safer way. If the sentence will not come, close the port. Attackers do not care which door was 'just for testing'; they inventory all of them equally.
2
The Three Doors That Must Never Open
The router's admin interface. Its password guards every device you own. There is no home-hosting reason for it to face the internet, ever - administer the router from inside the house.
Remote Desktop (3389). Consistently among the most attacked services on the internet, because a guessed password hands over the whole PC. If you need remote access to the machine, use a proper remote-access or VPN product built for the job - not a forwarded port.
File sharing (445/SMB). Built for trusted local networks. Exposed SMB has been the entry point of famous worm outbreaks; it does not belong on the internet side of any home router.
3
Aim the Doors at One Room Only - and Keep It the Same Room
A forwarding rule points at a single local IP address. That is exactly why the hosting PC needs a DHCP reservation in the router (or a static local address): the rule must always land on the server. Without it, the PC's address can drift - and the open ports do not close, they simply start pointing at whatever device inherited the address. A guest laptop does not deserve your website's exposure, and it certainly did not agree to it.
4
Router Hygiene That Matters More Than Any Single Setting
Change the default admin password. Factory passwords are printed in manuals the whole internet owns.
Update the router firmware. Routers are computers; their bugs get found and used. A yearly check is the minimum, and many routers update themselves if you let them.
Turn UPnP off unless you truly need it. UPnP lets programs inside your network open ports without asking you - the exact opposite of the discipline in this guide.
Disable remote (WAN-side) administration. Managing the router from the internet is a door, and it is not one of the two you are allowed.
5
Review the Door List Monthly
Routers accumulate history: rules from old experiments, a technician's temporary fix from two years ago, a game you no longer play. Once a month, open the forwarding page and read every rule. Each one should be explainable in seconds. The website needs two. An unexplained rule is not a mystery to live with - it is a door to close. Five minutes, twelve times a year, is the entire cost of knowing exactly how your house faces the internet.
🎥 Watch the Complete Process in the Video
Watch the video to see the two correct doors opened for the website - then apply this checklist to everything else on the list.
I forwarded a port yesterday. Am I already being attacked?
You are almost certainly already being scanned, which is normal and is not the same as being breached - the internet's background noise knocks on every address constantly. What protects you is the short door list and the service behind each door being patched and properly passworded. Panic is not required; discipline is.
Is moving the website to an unusual port like 8080 safer?
It reduces casual log noise and nothing else - anyone actually looking will find the service in seconds, and your visitors must now type the port in the address. Keep 80 and 443, keep the address clean, and spend the effort on patching and passwords instead.
What about the DMZ option in my router?
DMZ forwards essentially every port to one device - the opposite of this guide's discipline. It exists for rare troubleshooting, not for daily hosting. Never park your web PC in it: the website needs two doors, not all of them at once.
This guide is based on the Technical Anshu home website hosting video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏