diff --git a/Android.mk b/Android.mk
index 69859278f..40bc58eb2 100644
--- a/Android.mk
+++ b/Android.mk
@@ -73,7 +73,6 @@ ifeq ($(USE_OTBR_DAEMON), 1)
 OPENTHREAD_PUBLIC_CFLAGS                                         += \
     -DOPENTHREAD_CONFIG_PLATFORM_NETIF_ENABLE=1                     \
     -DOPENTHREAD_CONFIG_PLATFORM_UDP_ENABLE=1                       \
-    -DOPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE=1  \
     -DOPENTHREAD_POSIX_CONFIG_DAEMON_ENABLE=1                       \
     $(NULL)
 else
diff --git a/src/core/config/ip6.h b/src/core/config/ip6.h
index c38de0cf7..b84918fec 100644
--- a/src/core/config/ip6.h
+++ b/src/core/config/ip6.h
@@ -160,23 +160,6 @@
 #define OPENTHREAD_CONFIG_MPL_DYNAMIC_INTERVAL_ENABLE 0
 #endif
 
-/**
- * @def OPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE
- *
- * Define as 1 to enable dynamic unsecure port management
- *
- * If this feature is enabled, OpenThread will automaitically disable link-level
- * security for packets sent with unsecure source ports. Once we receive a secure
- * packet sent to the unsecure port, this port will be removed from the unsecure
- * port list.
- *
- * Enable only if you know well about its behavior.
- *
- */
-#ifndef OPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE
-#define OPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE 0
-#endif
-
 /**
  * @def OPENTHREAD_CONFIG_TCP_ENABLE
  *
diff --git a/src/core/config/openthread-core-config-check.h b/src/core/config/openthread-core-config-check.h
index c3a78fce4..b90e041f1 100644
--- a/src/core/config/openthread-core-config-check.h
+++ b/src/core/config/openthread-core-config-check.h
@@ -526,4 +526,8 @@
 #error "OPENTHREAD_CONFIG_PLAT_LOG_FUNCTION was removed and no longer supported"
 #endif
 
+#ifdef OPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE
+#error "OPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE was removed and no longer supported"
+#endif
+
 #endif // OPENTHREAD_CORE_CONFIG_CHECK_H_
diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp
index 1fe8b7faf..167883083 100644
--- a/src/core/net/ip6.cpp
+++ b/src/core/net/ip6.cpp
@@ -1217,22 +1217,6 @@ start:
             goto start;
         }
 
-#if OPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE
-        if (nextHeader == kProtoTcp || nextHeader == kProtoUdp)
-        {
-            uint16_t dstPort;
-
-            // TCP/UDP shares header uint16_t srcPort, uint16_t dstPort
-            SuccessOrExit(error = aMessage.Read(aMessage.GetOffset() + sizeof(uint16_t), dstPort));
-            dstPort = HostSwap16(dstPort);
-
-            if (aMessage.IsLinkSecurityEnabled() && Get<Filter>().IsUnsecurePort(dstPort))
-            {
-                IgnoreError(Get<Filter>().RemoveUnsecurePort(dstPort));
-            }
-        }
-#endif
-
         error = ProcessReceiveCallback(aMessage, messageInfo, nextHeader, aFromNcpHost,
                                        /* aAllowReceiveFilter */ !forwardHost, Message::kCopyToUse);
 
@@ -1285,35 +1269,21 @@ start:
             }
             VerifyOrExit(isAllowedType, error = kErrorDrop);
         }
-        if (aFromNcpHost && (nextHeader == kProtoTcp || nextHeader == kProtoUdp))
-        {
-            uint16_t sourcePort, destPort;
-
-            SuccessOrExit(error = aMessage.Read(aMessage.GetOffset(), sourcePort));
-            SuccessOrExit(error = aMessage.Read(aMessage.GetOffset() + sizeof(sourcePort), destPort));
-            sourcePort = HostSwap16(sourcePort);
-            destPort   = HostSwap16(destPort);
 
 #if !OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
+        if (aFromNcpHost && (nextHeader == kProtoUdp))
+        {
+            uint16_t destPort;
+
+            SuccessOrExit(error = aMessage.Read(aMessage.GetOffset() + Udp::Header::kDestPortFieldOffset, destPort));
+            destPort = HostSwap16(destPort);
+
             if (nextHeader == kProtoUdp)
             {
                 VerifyOrExit(Get<Udp>().ShouldUsePlatformUdp(destPort), error = kErrorDrop);
             }
-#else
-            OT_UNUSED_VARIABLE(destPort);
-#endif
-
-#if OPENTHREAD_CONFIG_UNSECURE_TRAFFIC_MANAGED_BY_STACK_ENABLE
-            // check whether source port is an unsecure port
-            if (Get<Filter>().IsUnsecurePort(sourcePort))
-            {
-                aMessage.SetLinkSecurityEnabled(false);
-                otLogInfoIp6("Disabled link security for packet to %s", header.GetDestination().ToString().AsCString());
-            }
-#else
-            OT_UNUSED_VARIABLE(sourcePort);
-#endif
         }
+#endif
 
 #if OPENTHREAD_CONFIG_MULTI_RADIO
         // Since the message will be forwarded, we clear the radio