Port reference
Port 80 (TCP) – HTTP
Cleartext HTTP — the unencrypted web protocol, normally redirected to HTTPS.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on virtually every web server by default. Almost always exposed to the internet, typically to redirect visitors to HTTPS.
What is port 80 used for?
Port 80 is the standard port for HTTP, the protocol web browsers use to load
websites. When you type http://example.com, your browser connects to port 80
by default. It is served by web server software such as Apache, Nginx, and
Microsoft IIS, as well as application frameworks and reverse proxies. Because
HTTP is unencrypted, most sites now use port 80 mainly to redirect visitors to
the secure HTTPS version on port 443.
When would you open it?
You open port 80 when you actually run a web server — for example, self-hosting a website, blog, or web app, or running a device whose admin panel is served over HTTP. It is also handy for local development and testing, and many setups keep it open so older or typed-in HTTP links still reach the site. Only forward it if something is genuinely listening for web traffic.
Is it safe to open?
The main risk is that HTTP traffic is sent in cleartext, so it should never carry logins or sensitive data — redirect to HTTPS and serve those over TLS. See the security notes below.
How to check if this port is open
ss -tulpn | grep :80
nmap -p 80 <target>netstat -ano | findstr :80
Test-NetConnection <host> -Port 80lsof -i :80
nmap -p 80 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 80 to your device's local IP, internal port 80, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 80/tcpsudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Traffic interception and credential/session sniffing (cleartext)
- Man-in-the-middle and SSL stripping
- Web app exploitation: SQLi, XSS, path traversal, RCE
- Automated vulnerability scanning and directory brute forcing
Hardening
- Redirect all HTTP to HTTPS (301) and serve no sensitive content on 80
- Enable HSTS with preload to force browsers onto TLS
- Put a WAF / reverse proxy in front and patch the web stack
- Disable directory listing and hide server version banners
- Rate-limit and monitor for scanning and brute force
How to block this port
sudo ufw deny 80/tcpsudo firewall-cmd --permanent --remove-port=80/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 80 -j DROPNew-NetFirewallRule -DisplayName "Block 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Blocknmap snippet
nmap -p80 --script http-title,http-headers,http-enum,http-methods <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is port 80 secure?
- No. HTTP on port 80 is cleartext, so anyone on the path can read or modify traffic. Use it only to redirect to HTTPS (port 443) and serve nothing sensitive over it.
- Can I just close port 80?
- You can, but most sites keep it open to redirect legacy and typed-in HTTP links to HTTPS. If kept open, it should do nothing but issue a 301 to the TLS site.