Port 80: HTTP
Port 80 is HTTP, unencrypted web traffic over TCP. Modern sites still answer on it, but almost always only to redirect the visitor to HTTPS on port 443 and to serve ACME challenges for certificate renewal.
| Port number | 80 |
|---|---|
| Service | Hypertext Transfer Protocol |
| Protocol | TCP |
| Category | Web |
| Default encryption | No |
| IANA service name | http, www, www-http |
| IANA transports | TCP, UDP, SCTP |
| Used in practice | TCP |
Can I just close port 80 entirely?
You can, and some hardened setups do, but two things break. First, anyone who types your domain without a scheme goes to port 80 by default, so closing it turns a working redirect into a connection error rather than sending them to HTTPS. Second, the ACME http-01 challenge that Let's Encrypt and similar certificate authorities use to prove domain control is served over port 80.
If you use the dns-01 challenge instead, which proves control by publishing a TXT record, the certificate problem goes away and closing port 80 becomes viable. HSTS with preloading also removes the need for the redirect for browsers that already know your site, though not for a first-ever visit from an unlisted client.
The practical middle ground almost everyone lands on is to keep port 80 open and serve nothing on it except a 301 to HTTPS.
Which ports are related to port 80?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
What commonly listens on port 80?
- nginx, Apache httpd and Caddy
- Traefik, HAProxy and cloud load balancers terminating the redirect to HTTPS
- Certbot and other ACME clients answering http-01 challenges
How do I check whether port 80 is open?
Port 80 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 80 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 80 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':80 ' | Lists the process bound to port 80 on Linux. On macOS use lsof -nP -iTCP:80 -sTCP:LISTEN, on Windows netstat -ano | findstr :80 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 80 TCP or UDP?
TCP. IANA registers http on TCP, UDP and SCTP at port 80, but the UDP and SCTP registrations are unused. HTTP/3 does run over UDP, but on port 443 alongside HTTPS, not on port 80.
Why is port 80 still open on sites that use HTTPS?
For two reasons: to catch visitors who typed the domain without https:// and redirect them, and to answer the ACME http-01 challenge that certificate authorities use to verify domain control at renewal time. Sites that use the dns-01 challenge instead can close port 80.
What is port 80 used for?
Port 80 is HTTP, unencrypted web traffic over TCP. Modern sites still answer on it, but almost always only to redirect the visitor to HTTPS on port 443 and to serve ACME challenges for certificate renewal.
Is port 80 secure?
Port 80 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 80 on my firewall?
Only if you specifically need HTTP. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.