Skip to main content
protocols.pageprotocols.page
80

Port 80 – HTTP

TCP

Port 80 is the default port for HTTP (unencrypted web traffic). Modern websites redirect all port 80 traffic to HTTPS on port 443 using HTTP 301 redirects. Browsers automatically try port 80 when no port is specified and the scheme is http://.

Port Number

80

Protocol

TCP

Service

Hypertext Transfer Protocol

Range

IANA Well-Known (0–1023)

Description

HTTP on port 80 is the original web protocol port. With HTTPS adoption near 100% for production sites, port 80 is primarily used to redirect users to HTTPS. Best practice is to serve an HTTP 301 redirect from port 80 to HTTPS with HSTS enabled on port 443.

Security risks

  • 1All traffic in cleartext: request URLs, headers, cookies, form data, and response bodies are visible to any network observer. Credentials submitted over port 80 are trivially captured via ARP spoofing or WiFi sniffing.
  • 2SSL-stripping attacks: without HSTS, an attacker on the network path can intercept the port 80 request BEFORE the 301 redirect fires, serving a spoofed HTTP version of the site. HSTS preload eliminates this window.
  • 3Cookie theft: cookies without the Secure flag are sent over port 80 connections. An attacker who forces a single HTTP request (mixed content, HTTP resource on HTTPS page) captures session cookies. Set Secure flag on ALL cookies.
  • 4SEO duplication: if port 80 serves content instead of redirecting, Google may index both HTTP and HTTPS versions, splitting link equity. Always 301 redirect, never serve content on port 80.

Firewall guidance

Allow inbound port 80 on web servers ONLY to serve 301 redirects to HTTPS. The redirect must happen at the web server level, not via firewall redirect – the client needs to receive the 301 response to update its URL. Block port 80 entirely on servers that do not serve web traffic. Never serve actual content on port 80 in production.

Diagnosis commands

Check if port 80 returns 301 redirect to HTTPS (expected) or serves content (bad)

shell
curl -I http://host/ 2>&1 | head -5

Follow redirects and show final URL – should end at https://

shell
curl -sL -o /dev/null -w '%{url_effective}
' http://host/

Show which process is listening on port 80

shell
ss -tnlp sport = :80

Retrieve HTTP headers – check for HSTS, X-Frame-Options, CSP

shell
nmap -p 80 --script http-headers target

Usage examples

Port 80 – HTTP
shell
curl http://example.com
telnet example.com 80
GET / HTTP/1.1

Common services on this port

NginxApache httpdCaddyIISTraefikHAProxyLighttpdNode.js http

Related ports

443

HTTPS (encrypted replacement)

8080

HTTP alternate (proxies, dev)

8000

HTTP dev server (Django, Python)

History

HTTP was created by Tim Berners-Lee at CERN in 1989. HTTP/0.9 (1991) supported only GET. HTTP/1.0 (RFC 1945, 1996) added headers and status codes. HTTP/1.1 (RFC 2068, 1997) added persistent connections. Port 80 was assigned by IANA as the default for HTTP and remains so even as traffic moves to HTTPS on 443.

FAQ

Can I just block port 80 entirely instead of redirecting?

No. If port 80 is closed, users who type 'example.com' (without https://) get a connection refused error instead of being redirected to HTTPS. Keep port 80 open and serve only a 301 redirect to https://. The redirect response is a few bytes and costs nothing.

Is port 80 still needed if I have HSTS preloaded?

HSTS preload means browsers that ship the preload list will never try port 80. But: not all browsers check preload lists, curl/wget do not honor HSTS, and bots follow http:// links. Keep the redirect active – it costs nothing and catches everything HSTS misses.

Specification

RFC 9110 – Port 80 specification →