Ports

RDP on the public internet: the single biggest ransomware vector for UK small businesses.

Published 2026-04-09 · Last updated 2026-04-09 · Vantyris editorial

What this means for your business

• Port 3389 (the standard RDP port) is the first thing every credential-stuffing botnet checks. Once they find an open one, they hit it with weak-password lists scraped from old data breaches. Multiple successful logins per day is the norm on any open port.
• Once an attacker gets in, they have an interactive Windows session as the user they compromised. From there they install ransomware, steal data, or use the foothold to move deeper into the network.
• The fix is almost never 'use a stronger password' or 'enable MFA on RDP'. Strong passwords and MFA help, but the underlying problem is exposing administrative services to the public internet at all. The fix is to put RDP behind a VPN or a Zero Trust gateway, so the port isn't directly reachable.

How to fix

Close port 3389 at your firewall. Provide remote access through a VPN (WireGuard, Tailscale, Cloudflare WARP) or a Zero Trust gateway (Cloudflare Access, Tailscale, Twingate). Most modern options are free for small teams.

1. Confirm the exposure. From outside your network, try connecting to your office's public IP on port 3389. Or look up your IP on shodan.io. If you see an RDP listener, the port is exposed.
2. Decide your replacement remote-access path. There are two cheap options. (1) Tailscale is free for up to 100 devices. Install the agent on the laptops and the office machine, and remote access works without exposing any ports. (2) Cloudflare WARP + Cloudflare Tunnel has a similar free tier and works the same way. Either one gets rid of the exposed port.
3. Roll out the VPN client to anyone who needs remote access. Install the chosen client on every remote worker's laptop and test that they can reach the office machine over the VPN. Write down how access works, so new hires don't ask 'but why can't I just RDP'.
4. Close port 3389 at your firewall. On your router or office firewall, remove the port-forward rule for 3389 (and any other admin port: 22 for SSH, 5900 for VNC, 5985-5986 for WinRM). Then test both ways. RDP should work over the VPN and fail from the public internet.
5. Audit other admin ports. While you're in the firewall, look for other commonly exposed admin services: SSH, MySQL, RDP, VNC, WinRM. Close anything without a deliberate business reason. The rule is 'admin services live behind the VPN, and only public-facing services (HTTP, HTTPS, SMTP) face the public internet'.

Owner: Your IT administrator or web host. For small businesses with no IT, your web host's support team can usually make the firewall changes. The VPN setup might need an outside contractor. · Time: 1-2 hours including VPN rollout to a small team.

Common gotchas

• Don't replace one exposed admin port with another. Some businesses 'fix' the RDP exposure by moving it to port 3390 or 33890. Bots scan every port, standard or not. The port number doesn't matter. The public exposure does.
• Strong passwords + MFA on RDP help but aren't the right fix. They're a partial mitigation. A VPN puts authentication in front of the port BEFORE the RDP layer, so the attacker can't even attempt the RDP login.
• Some businesses think 'we only allow our office IP through the firewall'. Static IP allow-listing works if your office IP is genuinely static, and most aren't (consumer-grade business broadband rotates). It also breaks the moment someone needs to work from home or travel.
• If an MSP or vendor has an SLA requiring 24/7 remote access, agree the VPN setup and the cutover with them before you close the port.

How to verify the fix

A Vantyris verified scan checks for exposed RDP and other admin ports in the Exposure category. Or look up your public IP on shodan.io after closing the port. Within 24-48 hours of the firewall change, it should show no RDP listener.

Cyber Essentials alignment

This finding informs the following Cyber Essentials control areas (the UK government's baseline scheme, a sound checklist in any country):

• A1. Firewalls: boundary protection between the internet and your services.
• A4. User access control: accounts assigned the minimum required privileges.

Vantyris is not a CE certifying body. The mapping above is informational.

Common follow-up questions

References

• NCSC: Remote Desktop Protocol NCSC
• CISA: RDP attacks alert CISA
• Microsoft: secure RDP configuration Vendor

Related explainers

• What a passive security scan can and cannot prove about your site.