591

Port 591/tcp is registered with IANA with the service name http-alt — not "filemaker" as many port lists show — and the description "FileMaker, Inc. - HTTP Alternate (see Port 80)," assignee and contact Clay Maeckel (a FileMaker engineer), and a blank reference field (dual-registered on TCP and UDP). It is an alternate HTTP port for FileMaker's web publishing, registered so that FileMaker web services can coexist with a web server already running on port 80. Historically FileMaker Pro's built-in Web Companion plug-in (FileMaker Pro 4/5, late 1990s) served Instant Web Publishing and Custom Web Publishing (CDML), and later versions used FileMaker Server's Web Publishing Engine; the protocol on 591 is essentially HTTP, so if port 80 is already in use an administrator sets the TCP/IP port to 591 and clients append ":591" to the URL. The IANA reference field is blank. Security-wise the modern footprint is minimal, but the real risk is a FileMaker database exposed to the internet — a data-exposure concern — and older FileMaker web publishing had its own vulnerabilities; an open 591 indicates FileMaker web access. For an analyst, an open 591 almost always means a FileMaker server with Instant or Custom Web Publishing enabled, and it should be treated as a web application with attention to whether database content is exposed.

IANA assignment

http-alt (NOT "filemaker") — "FileMaker, Inc. - HTTP Alternate (see Port 80)"; reference (blank — no RFC cited in IANA registry); assignee Clay Maeckel (FileMaker); dual-registered 591/tcp + 591/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low; nmap-services lists 591/tcp at de-facto low frequency [Well-established] — nmap-services file

Related ports

80 (HTTP), 5003 (fmpro — modern FileMaker client port)

Primary use

alternate HTTP port for FileMaker web publishing (coexists with a web server on 80)

Other/unofficial uses

generic alternate-HTTP labeling (the service name is http-alt) [Well-established]

Security implications

minimal footprint; the risk is an internet-exposed FileMaker database (data exposure); older FileMaker web publishing had vulnerabilities [Well-established]

Typically seen on

FileMaker servers with web publishing enabled

Analyst note

An open 591 almost always means a FileMaker server with Instant/Custom Web Publishing enabled; treat it as a web app and check for exposed data.