Before a new port goes public, five checks:
1. Firewall scope. Is the port open to the world, or only to the addresses that need it? Default to the smallest scope that works.
2. Authentication. Does the service ask for credentials before doing anything interesting? Default passwords and open panels are how boxes get owned.
3. Logs. Will you notice if something goes wrong? A service nobody watches is a service nobody fixes.
4. Updates. Is there a path to patch it without a weekend project? If updating is painful, it will not happen.
5. Rollback. Can you undo the change in one command? Every public change should have a way back.
Five minutes with this list saves the kind of afternoon nobody wants.