Web servers, with no open port.
A public web server has to answer on 80 and 443. Everything else it listens on is optional exposure.
What an open web servers port gives away
A web server is rarely listening on only its published ports. Management consoles, admin panels, deployment endpoints, staging virtual hosts and the SSH or RDP used to maintain the box are all reachable alongside the site itself.
Those secondary services are where the compromise usually starts. They receive far less scrutiny than the application, they are frequently left on defaults, and they are enumerated by the same scan that finds the website.
The port is closed, not hidden.
SSHepherd closes the listening ports that are not meant to be public, while the site keeps serving normally on 80 and 443.
Administrative access to the host — the shell, the management console, the deployment path — moves onto an outbound connection to the broker, reachable only by authorised identities.
- Nothing listens inbound
- Access via broker only
- Every session monitored
What your customer notices
Visitor traffic on 80 and 443 continues to be served as normal.
Management and deployment endpoints stop answering scans from the internet.
Non-production virtual hosts are no longer discoverable alongside the live site.
An application that cannot safely be upgraded is protected by being unreachable.
Watch the web servers demo.
Protect your IIS servers from hackers. A recorded demo from Full Armor, the developer of SSHepherd®.
Web servers: common questions
Will this affect visitors to my website?
No. Ports 80 and 443 continue to serve traffic normally. SSHepherd closes the management and administrative ports that were never intended to be public.
Does it work with both Apache and Microsoft IIS?
Yes. SSHepherd operates at the port level rather than inside the web server, so the same model covers Apache, IIS and the tooling around them.
Can it protect an application we cannot patch?
Yes, and this is a common reason to deploy it. An unpatched or end-of-life admin interface that cannot be reached from the internet cannot be exploited from the internet.