diff --git a/internal/setting/app.go b/internal/setting/app.go
index 08b4712..8db53c1 100644
--- a/internal/setting/app.go
+++ b/internal/setting/app.go
@@ -41,6 +41,7 @@ type settings struct {
 	TrustedPortHeader   string
 	EnableSecureHeaders bool
 	EnableHTTP3         bool
+	DisableTCPScan      bool
 	Server              serverSettings
 	Resolver            resolver
 	version             bool
@@ -111,6 +112,12 @@ func Setup(args []string) (output string, err error) {
 		false,
 		"Enable HTTP/3 protocol. HTTP/3 requires --tls-bind set, as HTTP/3 starts as a TLS connection that then gets upgraded to UDP. The UDP port is the same as the one used for the TLS server.",
 	)
+	flags.BoolVar(
+		&App.DisableTCPScan,
+		"disable-scan",
+		false,
+		"Disable TCP port scanning functionality",
+	)
 
 	err = flags.Parse(args)
 	if err != nil {
diff --git a/router/setup.go b/router/setup.go
index 8712103..ded52c6 100644
--- a/router/setup.go
+++ b/router/setup.go
@@ -24,7 +24,9 @@ func SetupTemplate(r *gin.Engine) {
 func Setup(r *gin.Engine, geo *service.Geo) {
 	geoSvc = geo
 	r.GET("/", getRoot)
-	r.GET("/scan/tcp/:port", scanTCPPort)
+	if !setting.App.DisableTCPScan {
+		r.GET("/scan/tcp/:port", scanTCPPort)
+	}
 	r.GET("/client-port", getClientPortAsString)
 	r.GET("/geo", getGeoAsString)
 	r.GET("/geo/:field", getGeoAsString)