Port 80HTTP

What port 80 is used for

Port 80 is where HTTP started and where a browser still goes when a URL begins with http:// or has no scheme at all. The traffic is plain text: anyone on the path between client and server can read and modify it. That is why the web has moved almost entirely to HTTPS on port 443, and why port 80 on a well-run server now does only two jobs:

1. Redirect to HTTPS. A request for http://example.com/page receives a 301 Moved Permanently to https://example.com/page. See the 301 record.
2. Serve certificate-validation files. The ACME HTTP-01 challenge, used by Let's Encrypt and other automated CAs, fetches /.well-known/acme-challenge/<token> over port 80 before issuing a certificate.

Other legitimate uses include captive-portal detection (operating systems make a plain HTTP request to a known URL to see if a login page intercepts it), some IoT device interfaces and internal tools that were never migrated.

Why plaintext still matters

Even a redirect on port 80 exposes the hostname and path of the first request. An attacker on the same Wi-Fi network can intercept that request and answer it with a different redirect. HTTP Strict Transport Security (HSTS) closes the gap: once a browser has seen the HSTS header from a site, it rewrites future http:// requests to https:// before sending anything.

Security considerations

• Serve nothing sensitive on 80. Login forms, APIs and admin panels belong on 443 only.
• Redirect with 301, not 302, so browsers and search engines treat HTTPS as canonical.
• Send HSTS on the HTTPS response, with a long max-age, once you are confident every subdomain works over TLS.
• Watch for unexpected listeners. On a workstation, something listening on port 80 is worth identifying: it may be IIS, a development server, Skype-style legacy software or a service you installed and forgot.

How to check port 80

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :80

A line in the LISTENING state means a local program has bound port 80; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :80 or lsof -i :80.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 80

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 80. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Watch a redirect happen with curl's include-headers option:

curl -I http://example.com/

A well-configured site answers HTTP/1.1 301 Moved Permanently with a Location: https://… header.

Firewall considerations

Web servers need inbound TCP 80 allowed if they perform HTTP-to-HTTPS redirects or use ACME HTTP-01 validation. Workstations do not need inbound 80. On Windows, the World Wide Web Services (HTTP Traffic-In) predefined rule is what IIS enables; if IIS is not installed, that rule should be absent or disabled.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 80 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.