Port 443HTTPS

What port 443 is used for

Port 443 carries HTTPS: ordinary HTTP requests and responses wrapped in a TLS session. When a browser loads https://example.com/, it resolves the name through DNS, opens a TCP connection to the server's IP address on port 443, completes a TLS handshake, and only then sends the HTTP request. Everything after the handshake, including the URL path, headers, cookies and body, is encrypted.

Because almost every website, API, mobile app back end and software update service uses HTTPS, port 443 is the most common destination port on the internet. Corporate firewalls almost always allow outbound 443, which is also why many non-web services (VPNs, messaging apps, remote-management agents) are configured to use it.

What the assignment means

IANA registers port 443 as https for both TCP and UDP. The TCP registration is the classic one. The UDP registration covers HTTP/3, which runs over QUIC rather than TCP. A server advertises HTTP/3 support through the Alt-Svc header or DNS HTTPS records; clients that understand QUIC then switch to UDP 443 for subsequent connections.

Encrypted, but not invisible

TLS protects the content of the exchange. It does not hide the fact that a connection to a given IP address happened, and the server name is usually visible in the ClientHello (SNI) unless Encrypted Client Hello is in use. Network operators can therefore see which hosts a client talks to on 443, but not what was requested.

Security considerations

• A listening 443 is expected on any web server. The question is what is behind it: keep the server software and TLS library patched, disable obsolete protocol versions (SSL 3.0, TLS 1.0 and 1.1) and prefer TLS 1.2 or 1.3.
• Certificates matter more than the port. A valid certificate from a trusted CA, renewed before expiry, is what lets clients verify they are talking to the right server. Expired or self-signed certificates produce browser warnings that train users to click through.
• Outbound 443 is rarely blocked. Because of that, malware and data-exfiltration tools also favour it. Filtering by destination and inspecting certificate details is more useful than blocking the port.
• Redirect 80 to 443. A server that answers on both should redirect plain HTTP to HTTPS with a 301 and send an HSTS header, so that first requests do not travel unencrypted.

How to check port 443

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :443

A line in the LISTENING state means a local program has bound port 443; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :443 or lsof -i :443.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 443

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 443. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Test the TLS layer itself with curl, which reports the negotiated protocol and certificate:

curl -vI https://example.com/

Firewall considerations

Servers that publish a website need inbound TCP 443 (and UDP 443 if they offer HTTP/3) allowed from the networks that should reach them. Workstations and home routers generally need no inbound 443 rule at all; browsers only make outbound connections. If a home router shows port 443 forwarded and you did not set it up, check which device it points to.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 443 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.