I am planning to make public a website I have been working on; it seems to me that the only way I can do this without needing to pay any extra money to external hosts etc. is by hosting the server from my computer at home.

I am worried about this. I trust the site itself is robust and secure — not vulnerable to injection attacks etc., but due to the act of simply serving a site via my router will attackers be able to get at other devices on my local network or access to my own personal computer (from which I intend to host the server)?

I have run nmap on my public ip, without my server running:

Nmap scan report for mypublicip
Host is up (0.0023s latency).
Not shown: 995 closed ports
53/tcp   open  domain
80/tcp   open  http
443/tcp  open  https
5000/tcp open  upnp
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 40.89 seconds

Are any of these services vulnerable? They are all managed by my router, and I haven't set any of them up.

The above results were from a device on my home network, so apparently they reflect ports my router exposes to devices already on its network.

Here are the nmap results from an external source:

Starting Nmap 6.00 ( http://nmap.org ) at 2016-08-26 15:44 EEST
NSE: Loaded 17 scripts for scanning.
Initiating Ping Scan at 15:44
Scanning mypublicip [4 ports]
Completed Ping Scan at 15:44, 0.06s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 15:44
Scanning mypublicip [100 ports]
Completed SYN Stealth Scan at 15:44, 4.25s elapsed (100 total ports)
Initiating Service scan at 15:44
Initiating OS detection (try #1) against mypublicip
Retrying OS detection (try #2) against mypublicip
Initiating Traceroute at 15:44
Completed Traceroute at 15:44, 0.04s elapsed
NSE: Script scanning mypublicip.

[+] Nmap scan report for mypublicip
Host is up (0.033s latency).
All 100 scanned ports on mypublicip are filtered

Too many fingerprints match this host to give specific OS details
Network Distance: 9 hops

What steps should I take to best reduce the chances of an attacker gaining access to my personal computer or other devices on my home network?

  • 2
    "if I visit my public IP address in the browser, my home router's page pops up, which also worries me." some routers do that. Ask a friend to visit your public IP. Aug 26, 2016 at 12:38
  • @SamuelShifterovich Ok I've now done this, and yes the results are very different (much less frightening) - I am about to update my question.
    – minseong
    Aug 26, 2016 at 12:58
  • 1
    That is most probably one of the widest and wildest question you might have fired. "Well, everyone, I swim pretty well. I will try to cross the Channel swimming with my personnal bath suit, is it safe?"••this is a return••May I suggest you to choose a more focused question to win some interesting answers?
    – dan
    Aug 26, 2016 at 13:48

3 Answers 3


You need to run the scan from outside of your network to get a valid result, since routers often have ports open for requests from inside the network but not from the outside.

Before deciding on hosting the website yourself you should also check if your ISP allows it and that you have a static IP-address.

If you configure everything correct and keep the whole stack updated all the time you should be relative safe, but even doing all this companies put their public facing servers in a DMZ to separate it from the inside of the network. So deciding on hosting it yourself depends on how big a target you see yourself as and how much you have to protect.

I did for some school projects have a server running for some days without publishing it any place and got lots of hacking attempts every day. I did also consider hosting some servers myself but ended up deciding to use DigitalOcean and would recommend you to also look for alternatives to hosting it yourself.

  • I don't think the DMZ is as important in a home LAN network vs corporate LAN. Mar 10, 2018 at 12:03

Of course, I am extremely scared of doing this; in the design on my site I have followed every security guideline I know of, but I'm scared attackers will still be able to get at other devices on my local network or access to my own personal computer (from which I intend to host the server.)


in the design on my site I have followed every security guideline I know of,

These guidelines don't mention anything about not having public-facing assets on the same network segment as resources you're concerned about? If you were a shopkeep would you leave your money just sitting in a pile on the same counter you serve customers from?

Personally I'm a strong proponent of not hosting web services from your home connection. Several reasons:

  • 99% chance you are violating the terms of your agreement with your ISP.
  • If you get compromised and your computer is used to serve spam, your ISP may cut off your internet access altogether.
  • If you get compromised and your computer is used to serve Very Bad Things, you're going to have FBI agents serving search warrants to your home and confiscating all your personal gear.
  • You violate what little security and privacy you have on your home LAN by opening up an exploitable public-facing entrypoint.

All of these things could be avoided with a $5/10-a-month webhost.

  • No EULA violations for hosting a web site (that's what you're paying for!).
  • At worst your host sends you an angry letter and stops hosting your site.
  • The FBI confiscates your host's equipment instead of yours.
  • You get more peace of mind at home.

DigitalOcean is the cheapest I've seen at $5, you can get AWS down to $6-7 a month with a fixed contract, or most other hosts charge $10. Scrape together a wad of cash and buy a disposable credit card if you must.

As a result of not being a cheapskate you will avoid a world of problems.

  • Note: If your cloud server is hacked and used to server "Very Bad Things" you may find your server is shutdown by the FBI contacting your cloud service. This is a very interesting topic in Cyber Security as "where does the file reside" aka "Where is the address for the warrant". Great point though, I never considered being hacked = losing my computer. Mar 10, 2018 at 13:00

...and if this is indeed an absolutely terrible idea I'd love pointers in a better direction.

I'm sure that it is an absolutely terrible idea (as I wondered about the same thing 10 years ago), especially if you are not extremely familiar with such hosting (even if you were, it would probably still be a bad idea).

Your alternate solution is simple : get a cheap VPS. Yeah you will probably have to pay, but you can get away with 5$/month no problem, supposing you don't want thousands of concurrent users (doing that from home would probably create an upload bandwidth issue anyways). Once you get your VPS (that is only accessible via SSH + certificates), harden it by following "hardening my VPS" guides and you're miles safer than risking to compromise your whole private network.

Also, you will learn lots of great nerdy Unix tricks !

Alternatively you could use a Shared Server but I would not recommand that if you want your server to be secure (shared servers are cheaper or free and showcase less performance but increase the security risks)

  • A shared hosting (not erver, hosting offer) would be far more secure than a VPS, even for a sysadmin knowing what (s)he's doing. A single person will always fail to follow up on security updates on their spare time. (my 2cts)
    – Tensibai
    Aug 26, 2016 at 13:31
  • 1
    @Tensibai Depends a lot on the provider - lots at the cheap end of the market don't bother patching at all, or have flaws in segregation between users. Moving up to higher levels, shared providers get better for the reasons you've stated, but in the low cost space, at least you know what you're running with a VPS.
    – Matthew
    Aug 26, 2016 at 13:43
  • @Matthew Most of the VPS run by 'home users' are an ideal target for botnets :p, again that's my 2cts, I've no stats to back that up.
    – Tensibai
    Aug 26, 2016 at 13:47
  • 1
    @Tensibai If they're set up poorly, yes. But I've never come across a site hosted on a VPS which is itself secure, but has been infected by an attack on another unrelated site - for shared hosting, though, it's common. A poor config is a poor config, whoever sets it up.
    – Matthew
    Aug 26, 2016 at 13:51
  • @Tensibai your answer is out of context as a "home user" would not use nmap and ask such questions. On top of that, not patching kernel exploits would not necessarily make you vulnerable, since by following a simple guide you would just open 3 ports (ssh, http, https), and only a specific remote code execution exploit in your app or in ssh would leverage a kernel flaw for example. Also, root login would be disabled etc, which is what all guides demand. In that situation you can still patch your server. On the shared server however, there is nothing you can do.OP is a person that
    – niilzon
    Aug 26, 2016 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .