I know that the default TCP port for MS SQL Server is 1433 and it is better to change that for some security reasons. But I want to know which port is better to choose instead of 1433 for SQL Server in order to work properly and not to intervene with the work of other programs? What if I choose a port which is already used by another program?

Thanks for your time!

  • 9
    I've always found changing the port for security reasons to be a bit underwhelming. If someone is scanning ports on an IP address, it doesn't matter if SQL Server is on 1433 or 143300. The scan will take maybe seconds and report SQL Server either way. Aug 1, 2018 at 18:18
  • 4
    How do you know it is better to change the port? If someone can get to the machine they can find the port. Aug 1, 2018 at 18:50
  • 4
    I can't stress this enough, changing the port does not add security. Period. It may take longer to identify which port but we're talking a matter of seconds. Aug 1, 2018 at 19:44
  • To further add to the chorus, IMO only bother with this if you need to punch holes in firewalls for named instances or compliance absolutely requires it and you have no other recourse. Outside of a reverse proxy I don't know a really good way to get around this. Aug 1, 2018 at 23:22
  • 1
    This is called “Security by Obscurity” and sometimes implemented in services exposed to the internet to prevent automated bots from running reconnaissance scans on known ports and services behind them. However, as others mentioned, for a database server - which will be in a secure network and hopefully not exposed to the internet directly - there is no security advantage. Aug 2, 2018 at 1:00

1 Answer 1


This question may be better suited to https://security.stackexchange.com/ as the idea and implications are not at all specific to SQL Server, they apply to any other internal service.

Changing the SQL Server instance port generally adds very little to security - it is a "theatre" action rather than a real security benefit, something to put on a checklist to make it look like you are doing lots for a security-in-depth policy[1]. If the browser service is still open anyone getting in can ask that what port SQL is listening on. Multiple instances of SQL on different ports is not uncommon so automated attacks against SQL Server will generally scan for instances on other ports if one is not found on 1433, while an attack could take some tens of seconds longer an automated attack bot has all the time in the world to wait.

If the outside world can see port 1433 then that is the problem (your firewall/other setup is too open) and changing ports probably won't fix that because the new port will likely be open to the world too. If an attacker is inside you infrastructure so can see the SQL Server listening port for that reason then you have a significant security problem elsewhere that moving SQL's port also won't help with.

[1] NOTE: I don't mean to imply that security in depth is a bad thing, it very much isn't. Security in depth should be a core goal of all environments. But try to avoid security theatre which adds hassle but not actually any real security benefit when you could be spending your time doing something else that actually does improve security.

Not the answer you're looking for? Browse other questions tagged or ask your own question.