Port reference
Port 8080 (TCP) – HTTP Alternate / Proxy
Alternate HTTP — app servers, proxies, and admin dashboards, often unencrypted.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open when an app server (Tomcat, Jenkins, etc.) or proxy is running. Frequently exposed to the internet by accident behind no TLS.
What is port 8080 used for?
Port 8080 is the most common alternate HTTP port. It is the default for many application servers and dev tools, including Apache Tomcat, Jenkins, JBoss/WildFly, and countless local web apps, and it is widely used as an HTTP proxy port. It is popular because it lets a web service run without root privileges or when port 80 is already taken. Traffic is usually plain HTTP, so it is unencrypted unless you add TLS in front of it.
When would you open it?
Open or forward 8080 when you are running an app server, proxy, or web app on it and need others to reach it. For anything internet-facing, most people put it behind a reverse proxy on 80/443 rather than exposing 8080 directly.
Is it safe to open?
Because 8080 often fronts admin dashboards and is unencrypted, exposing it carelessly is risky; require authentication and use HTTPS or a reverse proxy. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8080
nmap -p 8080 <target>netstat -ano | findstr :8080
Test-NetConnection <host> -Port 8080lsof -i :8080
nmap -p 8080 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8080 to your device's local IP, internal port 8080, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8080/tcpsudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action AllowSecurity & risks
Common attacks
- Exposed admin dashboards and consoles with default/no auth
- Cleartext interception (often plain HTTP, not TLS)
- Open proxy abuse and SSRF pivoting
- App-server and framework exploitation (e.g. Tomcat, Jenkins) and scanning
Hardening
- Never expose 8080 to the internet directly; bind to localhost or an internal VLAN
- Put it behind a TLS-terminating reverse proxy and require auth
- Disable default accounts and management/manager apps
- Restrict by IP allowlist / VPN and patch the app server
- Disable open-proxy behaviour and log access
How to block this port
sudo ufw deny 8080/tcpsudo firewall-cmd --permanent --remove-port=8080/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8080 -j DROPNew-NetFirewallRule -DisplayName "Block 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Blocknmap snippet
nmap -p8080 --script http-title,http-headers,http-enum,http-open-proxy <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 8080 used for?
- It is a common alternate HTTP port for application servers (Tomcat, Jenkins), proxies, and admin dashboards. It typically runs plain HTTP, so traffic is often unencrypted.
- Is it safe to leave port 8080 open?
- Not on the internet. Exposed 8080 frequently reveals admin consoles or open proxies with weak or no authentication. Bind it internally or front it with an authenticated TLS reverse proxy.