Port 80 HTTP · TCP

What runs on port 80

HTTP, unencrypted. Today its main job is to receive a request and redirect to HTTPS, and to answer the ACME HTTP-01 challenge that Let's Encrypt uses to issue certificates. Serving real content on 80 marks a site as "not secure" in browsers and makes every form submission readable on the path.

Software that uses it: nginx · Apache httpd · Caddy · HAProxy · IIS · any app server

Should port 80 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Keep 80 open and redirect everything to 443 with a 301; add HSTS on the HTTPS side so the redirect is only needed once per browser.
• Certbot and Caddy need inbound 80 for HTTP-01; the DNS-01 challenge is the alternative.

Check port 80

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :80'
sudo lsof -i :80

# from another machine: is it reachable?
nc -zv host 80
nmap -p 80 host
curl -v telnet://host:80      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 80

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 80 proto tcp
sudo ufw deny 80/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 80 accept
nft add rule inet filter input tcp dport 80 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=80 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 80" with no source is just "open".

Putting it behind nginx

server {
    listen 443 ssl;
    server_name app.example.com;
    location / {
        proxy_pass http://127.0.0.1:80;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Then make the application listen on 127.0.0.1:80 only. Test which location block a request hits with the nginx location tester.

Related ports

• 443 HTTPS — Web over TLS; UDP for HTTP/3 (QUIC)
• 8080 HTTP alt — Tomcat, proxies, dev servers
• 8000 dev servers — Django, python -m http.server
• 8008 HTTP alt

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions