Skip to content
For your server

Server Health Check for VPS & Dedicated Servers

With the Server Health Check, you can check your VPS or Dedicated Server from outside with one click: reachability, seven key ports, SSL certificate, blacklists and reverse DNS, plus SPF and DMARC when a matching domain is available. The result uses traffic-light colors and provides specific advice on what to do.

Built by Eric Mager

Included at no extra cost in your VPS or Dedicated Server Dashboard: no installation, no agent on the server, and only your own server is checked.

Don't have your own server yet? The health check is built right into the VPS Dashboard.

This check is available in your Dashboard

The Health Check only checks your own server, so it is available only in the Dashboard. Open your VPS or Dedicated Server there and select Health Check in the “Tools” tab.

Check external addresses? Use our port checker instead

What the check covers

Check your server from outside: ports, SSL and blacklists in one check

The checks run from outside against your server's primary public IPv4 address, each with its own timeout.

Reachability

The check does not ping your server; it establishes TCP connections. Any response on one of the checked ports counts as reachable. The time shown is how long the connection took to establish. If the Dashboard shows that the server is off or suspended, the result says so.

Open ports

The check covers SSH (22), RDP (3389), HTTP (80), HTTPS (443), SMTP (25), MySQL (3306) and PostgreSQL (5432). A MySQL or PostgreSQL port open to the internet is red; an open RDP port is yellow. If port 80 is open but port 443 is unreachable, you get a yellow HTTPS advisory.

SSL Certificate

The certificate is checked only if port 443 is open. The row is yellow if less than 30 days remain, and red if less than 14 days remain or the certificate has expired. A self-signed certificate is yellow. The check evaluates trust and hostname matching when a hostname points to your server's IP.

Blacklists

Your server's IPv4 address is checked against blacklists. One listing is yellow; two listings or a listing for exploits are red. Lists for dynamic address ranges, such as Spamhaus PBL, and listings that only affect the surrounding network range stay green.

Reverse DNS (rDNS)

The check reads the IP's PTR record and checks whether the hostname points back to the same IP via an A record. If the PTR record is missing or does not point back, the row is yellow. This is especially important if your server sends emails.

SPF and DMARC

If your server's hostname resolves to its IP, the check also checks the domain's SPF and DMARC records. Missing records or an SPF record with issues are yellow. If your server doesn't send emails, you can ignore these advisories.

Result

How to read the traffic-light results

Each row in the result has one of four levels. Yellow and red rows include specific advice on what to do.

Green: OK

This item looks fine; you don't need to do anything.

Yellow: Advisory

Nothing here is urgent, but it's worth a look. The advice below the row tells you what you can do.

Red: Action needed

You should address this soon, such as an open database port or a certificate nearing expiry.

Gray: Unknown

The check did not return a usable response, for example because it timed out. Try again in a moment.

The overall result above is based on the worst row. Gray rows never turn it yellow or red.

How it works

Check your server's health in six steps

From the Dashboard to green results, with no installation on the server.

  1. Step 1

    Open server in Dashboard

    Sign in to ZAP-Hosting and open your VPS or Dedicated Server in the Dashboard.

  2. Step 2

    Select Health Check

    Go to the “Tools” tab and select Health Check.

  3. Step 3

    Start check

    Click “Start Check.” Your server's address is used automatically; you don't need to enter anything.

  4. Step 4

    Read the status indicator

    Read the overall result at the top, then the rows in Reachability, Open Ports, Security & Reputation and Email DNS.

  5. Step 5

    Follow the advice

    Every yellow or red row includes actionable advice, such as restricting a database port with a firewall, renewing the SSL certificate or setting a PTR record.

  6. Step 6

    Check again

    After making changes, click “Check Again” to run the check again. The button is disabled for 10 seconds after each run.

Other addresses

Check other servers, IPs, and domains

The Health Check only checks your own server. For other addresses and continuous monitoring, use our public tools.

FAQ

Frequently asked questions about the Server Health Check

Quick answers about ports, SSL certificates, blacklists, reverse DNS and the traffic-light colors.

It checks TCP reachability; ports 22 (SSH), 3389 (RDP), 80 (HTTP), 443 (HTTPS), 25 (SMTP), 3306 (MySQL) and 5432 (PostgreSQL); the SSL certificate (only if port 443 is open); blacklist status; and reverse DNS. SPF and DMARC are also checked if the server's hostname resolves to its IP. The check uses the primary public IPv4 address, not IPv6.

No. The check only checks your own VPS or Dedicated Server. The address comes from your account, not from anything you enter. For other addresses, use our public tools. Port CheckerSSL CheckerIP Blacklist Checker

In the “Tools” tab of your VPS or Dedicated Server Dashboard. It's included at no extra cost, and you don't need to install anything on the server. The owner and anyone the server is shared with who has permission to view it can start the check.

Green means “OK,” yellow means “Advisory,” and red means “Action needed.” Gray means “Unknown”: the check did not return a usable response. The worst row determines the overall result; gray rows never turn it yellow or red.

A MySQL port (3306) or PostgreSQL port (5432) reachable from the internet is red: use a firewall to allow only the necessary IPs, or bind the database to 127.0.0.1. An open RDP port (3389) is yellow; restrict it to your own IP or use a VPN. Ports 80 and 443 are normal; port 80 without 443 only triggers an HTTPS advisory.

The row turns yellow when fewer than 30 days remain, and red when fewer than 14 days remain or the certificate has expired. A self-signed certificate appears yellow. If no hostname points to your server, the IP is checked: To get a trusted certificate, point a domain to the server and use a service such as Let's Encrypt.

First fix the cause, such as an open mail relay or compromised account, then request removal from the relevant blacklist. If the listing suggests exploits, check the server for malware and open proxies. If the IP is only on a list of dynamic address ranges, such as Spamhaus PBL, or only the surrounding network range is listed, this is not a concern for servers.

No. The check only runs when you start it and checks your server from outside. It does not measure CPU, RAM or disk usage. For continuous monitoring with notifications, use our Server & Website Monitoring. Server & Website Monitoring

Any more questions?

Contact Support

Looking for more tools? View all server tools