Skip to main content
IMMUNITYSEC

Port 9090: Prometheus server web UI and API, Cockpit web console

IANA registers 9090 as websm (WebSM). The Prometheus server serves its expression browser and its own metrics on localhost:9090 in the getting started guide, and the Cockpit Linux administration console is reached at https://host:9090 with system user accounts.

9090
TCP

Port Details

Port
9090
Transport
TCP
Service
Prometheus / Cockpit
IANA service name
websm
Range
User port (1024-49151)
Related ports
9100

Security Exposure

The Prometheus security model presumes that untrusted users with access to the HTTP endpoint can read all time series in the database and a range of operational and debugging information. Cockpit on the same port logs in with system user accounts and passwords, so an exposed console accepts login attempts against those accounts.

Hardening

  • +Restrict 9090 to monitoring and administration networks with host or network firewalls.
  • +Configure TLS and basic authentication or client certificates through the Prometheus web configuration file.
  • +Leave the Prometheus admin API (--web.enable-admin-api, disabled by default) and the --web.enable-lifecycle endpoints off unless required.
  • +Limit Cockpit access to administrators and avoid exposing it to the internet.

Monitoring

Review reverse proxy or web logs for queries from unexpected clients, and alert on failed logins to Cockpit. Track hosts that newly expose 9090.

Tools for Auditing and Monitoring Prometheus / Cockpit

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Nuclei

Free / Commercial
Vulnerability Scanning

Fast vulnerability scanner powered by community YAML templates to scan web applications, networks, and cloud targets for known defects.

LicenseMIT
PlatformLinux, macOS, Windows

Shodan

Freemium
Open Source Intelligence Tools

Search engine for Internet-connected devices that indexes service banners, open ports, and exposed assets across public IP space.

LicenseProprietary (service); MIT (Python client)
PlatformWeb, Linux, macOS, Windows

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

What is port 9090 used for?→

It is the default port for the Prometheus server and for the Cockpit web console. IANA's registration is websm.

Does Prometheus have authentication on port 9090?→

Prometheus supports TLS and HTTP basic authentication through its web configuration file. Its security model assumes untrusted users with HTTP access can see all metrics, so access should be restricted.

Is port 9090 TCP or UDP?→

Prometheus and Cockpit both use HTTP over TCP. IANA lists both transports for websm.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 9090 is not guaranteed to be Prometheus / Cockpit. Exploited-in-the-wild data from the CISA KEV catalog (CC0).