Port 80: Hypertext Transfer Protocol
Port 80 is the default port for the http URI scheme. RFC 9110 states that TCP port 80 is used when an http URI gives no port, while https defaults to TCP port 443. Web servers, reverse proxies, and HTTP management interfaces on network devices listen on it.
Port Details
Security Exposure
Traffic on port 80 has no TLS protection, unlike https, which RFC 9110 defines with confidentiality and integrity protection. Credentials, session cookies, and content sent over plain HTTP can be read or changed in transit. MITRE ATT&CK also lists HTTP management services on 80/TCP among targets of password guessing, and the risk of an exposed port 80 depends heavily on the application behind it.
Hardening
- +Redirect HTTP requests to HTTPS and serve content and logins only over TLS.
- +Send a Strict-Transport-Security header so browsers use HTTPS for later visits (RFC 6797).
- +Keep device and application administration interfaces off internet-facing port 80.
- +Patch web server and application software, and remove default pages and unused modules.
Monitoring
Review web server access logs for repeated authentication failures on administrative paths, scanner user agents, and unexpected HTTP methods. Regular port inventories should account for every host listening on port 80.
Tools for Auditing and Monitoring HTTP
Nikto
Free / CommercialWeb server scanner that inspects web hosts for dangerous files, outdated server software, and misconfigured HTTP headers.
ZAP
Open SourceOpen-source web application security scanner and intercepting proxy for detecting web flaws during development and testing.
Nuclei
Free / CommercialFast vulnerability scanner powered by community YAML templates to scan web applications, networks, and cloud targets for known defects.
Related Tool Categories
Static source analysis, dynamic scanners, and dependency vulnerability checkers.
Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.
Infrastructure scanners, CVE audit engines, container image inspectors, and exposure management platforms.
Frequently Asked Questions
Is port 80 TCP or UDP?→
HTTP on port 80 uses TCP. RFC 9110 names TCP port 80 as the default for http URIs, even though IANA also lists UDP and SCTP entries.
What is the difference between port 80 and port 443?→
Port 80 is the default for http and port 443 is the default for https, which runs HTTP over TLS (RFC 9110).
Should port 80 be closed?→
Many sites keep port 80 open only to redirect visitors to HTTPS. HSTS (RFC 6797) then tells browsers to use secure connections directly on later visits.
Sources
Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 80 is not guaranteed to be HTTP. Exploited-in-the-wild data from the CISA KEV catalog (CC0).