ERR_UNSAFE_PORT: Why Chrome Blocks a Port and What to Use Instead

ERR_UNSAFE_PORT appears when you open a URL that uses a port number the browser refuses to connect to. Chrome shows "This site can't be reached. The webpage at http://example.com:6000/ might be temporarily down" with the code ERR_UNSAFE_PORT. Nothing is wrong with your server; the browser decided not to send the request at all, so no packet leaves your machine.

Browsers keep a list of "bad ports" that belong to well-known non-web protocols such as mail, FTP, IRC, SSH and databases. The purpose is defense against cross-protocol attacks, where a malicious web page tricks a browser into sending HTTP-shaped data at, say, an SMTP or IRC server and injecting commands. The list is defined in the WHATWG Fetch standard, and Chrome, Firefox and Safari each maintain closely related lists.

Which ports are blocked

The list is long and changes occasionally, so use the Fetch standard's "bad port" list as the source of truth. Ports you are most likely to run into include:

• 22 (SSH), 23 (Telnet), 25, 465, 587 (SMTP), 110 and 995 (POP3), 143 and 993 (IMAP)
• 21 (FTP), 53 (DNS), 111, 135, 139 (NetBIOS), 2049 (NFS)
• 6000 (X11) and 6665 to 6669 and 6697 (IRC)
• 5060 and 5061 (SIP), 4045, 10080

Common web ports such as 80, 443, 8080, 8443, 3000, 5000 and 8000 are not in the list. If you hit the error with a number you did not expect, check the current standard rather than assuming.

Quick diagnosis

1. Look at the address bar. Is there a :NNNN that matches a blocked port?
2. Try the same URL with curl. If curl works and the browser does not, the port block is confirmed:

curl -I http://example.com:6000/

1. Parse the URL with the URL Parser to be sure the port is what you think it is. A mistyped link such as http://example.com:6666 is a common source.
2. Use the Port Checker to confirm the server itself is listening on that port from the outside.

Fixes

Move the service to a different port (recommended)

For anything that a browser must reach, use a normal web port. Change the listener in your server:

server {
    listen 8081;
    server_name example.com;
}

Listen 8081
<VirtualHost *:8081>
    ServerName example.com
</VirtualHost>

Reload, update firewall and cloud security-group rules to allow the new port, and update any bookmarks, webhooks and documentation.

Put it behind a reverse proxy on 80 or 443

Better still, let nginx or Apache listen on 443 and proxy to whatever internal port the app uses. Visitors never see an odd port. It also gives you HTTPS, caching and logging in one place. See Apache vs nginx troubleshooting.

Use a different client for non-HTTP services

If the port belongs to a real non-web protocol, do not use a browser. Use ssh, an IRC client, a mail client, or curl, which does not enforce the browser list.

Overriding the block (for local testing only)

Chrome supports a command-line switch, --explicitly-allowed-ports=6000, which permits specific ports. This affects only that browser instance on your machine and does nothing for your visitors. Do not rely on it for production; it is only for a developer who has no choice. Firefox has a preference, network.security.ports.banned.override, for the same purpose.

Webhooks and API clients

Server-side HTTP libraries such as curl, Python requests and Node's fetch from the server do not apply browser port blocks (although the WHATWG fetch implementation in some runtimes may). If a third-party service refuses to call your webhook on an unusual port, check its documentation; many only allow 80 and 443.

Verify

After changing the port, load the URL in a normal window, then check the response with the HTTP Status Checker. Confirm the old port is closed if you no longer want it exposed, and add the new URL to your monitoring. An Uptime Monitor can watch an HTTP URL on any allowed port.

Next steps

• Compare with ERR_CONNECTION_REFUSED when the port is allowed but nothing listens.
• Read ERR_CONNECTION_TIMED_OUT for firewall-related failures.
• Learn about ports in the glossary.
• Triage the whole stack with why is my website down.

FAQ

Is my server down if I see ERR_UNSAFE_PORT?

Probably not. The browser never contacted it. Test with curl or the Port Checker to see whether the server responds.

Is it safe to use the Chrome override flag?

For local testing in a separate profile, yes with care. It is not a fix for your users, who will still be blocked.

Why is port 6000 blocked?

It is the traditional X11 display port, and ports around it are associated with protocols that browsers do not want to speak to.

Do all browsers block the same ports?

The lists are very similar but not identical. A port that works in one browser may be blocked in another, so choose a port outside the standard list.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.