Port reference
Port 8000 (TCP) – HTTP Alternate / Dev Server
Alternate HTTP — frequently a development web server (Django runserver, Python http.server), no fixed service.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open when a dev or app server is running. Often plain HTTP and bound to all interfaces by mistake.
What is port 8000 used for?
Port 8000 is a popular alternate HTTP port, most often used by local development web servers. It is the default for Django's runserver, Python's built-in http.server, Uvicorn, and many other frameworks and tools. There is no single fixed service tied to it, so on any given machine it could be a quick file share or a full application during development. It usually serves plain HTTP without encryption.
When would you open it?
Open 8000 when you want to reach a development server from another device on your local network, such as testing a site from your phone. For real production traffic, run a proper web server and put it behind a standard HTTP/HTTPS setup rather than exposing 8000 directly.
Is it safe to open?
Development servers are built for convenience, not exposure, and often leak debug information, so keep 8000 on localhost or your private network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8000
nmap -p 8000 <target>netstat -ano | findstr :8000
Test-NetConnection <host> -Port 8000lsof -i :8000
nmap -p 8000 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8000 to your device's local IP, internal port 8000, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8000/tcpsudo firewall-cmd --permanent --add-port=8000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8000 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8000" -Direction Inbound -Protocol TCP -LocalPort 8000 -Action AllowSecurity & risks
Common attacks
- Accidentally exposed debug/development servers with full stack traces
- Cleartext interception (usually plain HTTP, not TLS)
- Directory listing and source disclosure via http.server
- Framework debug-mode RCE and information leakage
Hardening
- Never run a dev server on 8000 in production or on a public interface
- Bind to 127.0.0.1 and reach it through a TLS reverse proxy with auth
- Disable framework debug mode (e.g. Django DEBUG=False) when reachable
- Restrict by IP allowlist / VPN and add authentication
- Log access and patch the application server
How to block this port
sudo ufw deny 8000/tcpsudo firewall-cmd --permanent --remove-port=8000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8000 -j DROPNew-NetFirewallRule -DisplayName "Block 8000" -Direction Inbound -Protocol TCP -LocalPort 8000 -Action Blocknmap snippet
nmap -p8000 --script http-title,http-headers,http-enum <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 8000 used for?
- It is a common alternate HTTP port, most often a development web server such as Django's runserver or Python's http.server. There is no single fixed service, so always fingerprint what is actually listening.
- Is it safe to expose port 8000 to the internet?
- No. Dev servers on 8000 are single-threaded, unhardened, and frequently run with debug mode on, leaking stack traces and sometimes allowing code execution. Bind it to localhost and front it with an authenticated TLS proxy.