Port reference
Port 443 (TCP) – HTTPS
HTTPS — HTTP encrypted with TLS, the default secure web protocol.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on virtually every public web server. Almost always exposed to the internet to serve encrypted websites and APIs.
What is port 443 used for?
Port 443 carries HTTPS, which is regular web traffic (HTTP) wrapped in TLS encryption. Every time you visit a site starting with https://, your browser connects here. It is the standard port for secure websites, REST and GraphQL APIs, and most modern apps, served by web software like Nginx, Apache, Caddy, and IIS.
When would you open it?
Open or forward port 443 when you host a public website, web app, or API that people reach over the internet. Home users rarely need to open it manually, since outgoing connections work without any changes. Only expose it if you actually run a web server that should be reachable.
Is it safe to open?
It is normal and safe to expose 443 for a real website, as long as you use a valid certificate and a modern TLS configuration. See the security notes below.
How to check if this port is open
ss -tulpn | grep :443
nmap -p 443 <target>netstat -ano | findstr :443
Test-NetConnection <host> -Port 443lsof -i :443
nmap -p 443 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 443 to your device's local IP, internal port 443, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 443/tcpsudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 443 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 443" -Direction Inbound -Protocol TCP -LocalPort 443 -Action AllowSecurity & risks
Common attacks
- Weak/deprecated TLS and cipher exploitation (SSLv3, TLS 1.0/1.1, RC4)
- Certificate issues: expired, self-signed, mismatched, weak keys
- Web app exploitation (SQLi, XSS, RCE) over the encrypted channel
- DoS/DDoS and TLS renegotiation abuse
Hardening
- Disable SSLv3 and TLS 1.0/1.1; prefer TLS 1.2/1.3 with strong ciphers
- Use valid certificates with strong keys and automate renewal
- Enable HSTS and disable insecure renegotiation/compression
- Keep OpenSSL and the web stack patched (e.g. Heartbleed)
- Front with a WAF and monitor TLS posture continuously
How to block this port
sudo ufw deny 443/tcpsudo firewall-cmd --permanent --remove-port=443/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 443 -j DROPNew-NetFirewallRule -DisplayName "Block 443" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Blocknmap snippet
nmap -p443 --script ssl-enum-ciphers,ssl-cert,http-title,http-headers <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 80 and 443?
- Port 80 is cleartext HTTP; port 443 is HTTPS, the same protocol wrapped in TLS encryption. Use 443 for all real traffic and 80 only to redirect to it.
- Does HTTPS on 443 make my site secure?
- TLS encrypts the connection but does not fix application bugs. Weak ciphers, bad certificates, or vulnerabilities like Heartbleed (CVE-2014-0160) can still expose data.