Visual guides
An open port means a service responds on an address. It can be normal or risky depending on service, origin and configuration.
Ports 80 and 443 are usually expected for public websites.
SSH, RDP or database ports exposed to the internet require strict controls.
Rules should limit services to who actually needs them.
A website needs open ports to work. The point is verifying whether the service is expected and protected.
Administration or database ports open to the whole internet usually deserve priority attention.
A careful review uses low intensity, does not try passwords, does not exploit services and stays limited to authorized targets.
FAQ
No. The audit is designed for one authorized target, not mass scanning.
It depends on firewall context, but both are usually less exposed signals than open.