Port 5985 — WinRM HTTP
Quick reference for TCP/UDP port 5985, used by WinRM HTTP. Includes what the service does, security guidance and related ports.
What is port 5985?
Windows Remote Management (HTTP).
What port does WinRM HTTP use?
WinRM HTTP listens on port 5985 by default.
Security guidance
High risk — do not expose to the internet
Port 5985 (WinRM HTTP) is high-risk because the service it carries is a frequent target for credential attacks, brute force or unpatched-vulnerability scanning. Keep it bound to localhost or your VPN, never forward it directly on a router, and require strong authentication.
Related ports
Frequently asked
What is port 5985 used for?+
Port 5985 is the standard TCP/UDP port for WinRM HTTP. Windows Remote Management (HTTP).
What port does WinRM HTTP use?+
WinRM HTTP listens on port 5985 by default.
Your IP Address Is Exposed Right Now
Every website you visit can see your real IP address and location. NordVPN encrypts your traffic and hides your identity with military-grade encryption. Stay anonymous online.