BRev Port 80 — HTTP
Port 80/TCP is unencrypted HTTP, and in a modern deployment its job is mostly to hand visitors to port 443. It stays open because people still type bare hostnames and paste http:// links — a site that simply closes 80 gives those visitors a connection error rather than a redirect, which reads as “the site is down”.
The second reason to keep it is certificates. The ACME HTTP-01 challenge used by Let’s Encrypt is served over port 80 specifically, on purpose: it validates control of the name without depending on the certificate you are trying to obtain. Firewall 80 shut on a host that renews with HTTP-01 and the renewal fails silently until the certificate expires — the classic “everything worked for 89 days” outage. DNS-01 is the alternative if you genuinely want 80 closed.
Our reference marks 80 safe to expose, with the obvious caveat: safe to have open, not safe to serve real content on. Anything sent over it — a login form, a session cookie, an API token — is readable and modifiable in transit by anyone on the path. Serve a 301 to HTTPS and nothing else, and add HSTS on the HTTPS side so browsers stop trying port 80 at all after the first visit.
Port 80 at a glance
| Field | Value | Detail |
|---|---|---|
| Port | 80 | Well-known |
| Service | HTTP | Plain-text web traffic. (TCP) |
| Category | Web | HTTP(S) and things browsers speak |
| Exposure | Safe | Safe to expose |
Should port 80 face the internet? Public by design — but redirect it to HTTPS; never serve logins over it.
Built to face the internet: authenticated, encrypted, and expected to take unsolicited connections. Still patch it.
What commonly goes wrong
“Port 80 already in use” or “permission denied” when binding
Two separate causes. Ports below 1024 are privileged on Unix, so a non-root process cannot bind 80 at all — that is EACCES, not a conflict; the fix is a capability (setcap cap_net_bind_service), a reverse proxy, or running the listener higher and redirecting. A genuine conflict is usually an already-running Apache, nginx, or on Windows the HTTP.sys stack claimed by IIS or even Skype. The local commands on this page name the PID.
Certificate renewal fails after locking the firewall down
HTTP-01 validation needs inbound port 80 from anywhere — the validating servers are not a fixed list you can allow-list narrowly. If 80 must stay closed, switch the issuance method to DNS-01, which proves control through a TXT record instead and works for internal hosts that have no public HTTP at all.
Check port 80 yourself
No browser can open a raw TCP socket, so no web page can honestly tell you whether this port is open on a remote host. These are the real commands, generated for port 80 — swap example.com for the host you are actually testing.
Is port 80 reachable on another host?
nc -vz example.com 80"succeeded!" means the TCP handshake completed — the port is open. "Connection refused" is closed; a hang until timeout means filtered (a firewall dropped it silently).
nmap -Pn -p 80 example.comThe only common tool that distinguishes open / closed / filtered. -Pn skips the ping sweep, so it still works against hosts that ignore ICMP.
Test-NetConnection example.com -Port 80Read TcpTestSucceeded: True = open. It is built in — nothing to install.
telnet example.com 80A blank screen or a banner means it connected. "Connection refused" means closed. Quit with Ctrl-] then `quit`.
curl -v --max-time 5 telnet://example.com:80Handy when telnet is not installed: "Connected to …" proves the TCP handshake, without curl trying to speak HTTP.
What on this machine is holding port 80?
sudo ss -tlnp | grep :80Lists the listening socket and the PID/program holding it. Drop sudo and you get the socket but not the process name.
sudo lsof -i :80The macOS answer to "address already in use". Kill it with `kill -9 <PID>` once you are sure what it is.
netstat -ano | findstr :80The last column is the PID. Match it in Task Manager’s Details tab, or `taskkill /PID <pid> /F`.
No web page can tell you whether a port is open on a remote host
A browser cannot open a raw TCP socket — there is no API for it, by design. So a site that reports “port 3389 is OPEN on 203.0.113.10” is not checking from your browser; it is asking its own server to scan on your behalf. That works, but it means their server sees the host you asked about, scans from their address rather than yours, and answers a question about their network path, not yours.
We don't have a server here and won't pretend to. So this page does three honest things instead:
| Port | Proto | Service | What it is | Exposure | |
|---|---|---|---|---|---|
| 80 | tcp | HTTP | Plain-text web traffic.Public by design — but redirect it to HTTPS; never serve logins over it. | Safe | |
| 1080 | tcp | SOCKS proxy | Generic TCP proxy.An open SOCKS proxy will be found and used to launder someone else’s traffic. | Never | |
| 1801 | tcp | MSMQ | Microsoft Message Queuing.QueueJumper (CVE-2023-21554) was pre-auth RCE in a single packet. | Never | |
| 2380 | tcp | etcd peer | etcd node-to-node replication.Cluster-internal; joining it means owning the cluster. | Never | |
| 5800 | tcp | VNC over HTTP | Java/HTML VNC viewer delivery.The web front door to a remote desktop. | Never | |
| 7180 | tcp | Cloudera Manager | Hadoop cluster management UI.Cluster-wide administrative control. | Never | |
| 8000 | tcp | HTTP alt / dev server | Django, `python -m http.server`, and countless others.The one-line file server exposes your working directory to the world. | Never | |
| 8005 | tcp | Tomcat shutdown | Sends Tomcat the shutdown command.A word on a socket stops your application server. | Never | |
| 8006 | tcp | Proxmox VE | Proxmox web management interface.Hypervisor control — VPN it, always with 2FA. | Care | |
| 8008 | tcp | HTTP alt / Chromecast | Alternate HTTP, Chromecast control, Matrix Synapse.Depends entirely on what is behind it. | Care | |
| 8009 | tcp | AJP (Tomcat) | The Apache JServ connector.Ghostcat (CVE-2020-1938) read and executed files through it. It is not an internet protocol. | Never | |
| 8020 | tcp | Hadoop NameNode | HDFS metadata RPC.Filesystem-wide access to the cluster. | Never | |
| 8025 | tcp | MailHog / Mailpit | Local mail-catcher web UI.Every test email your app sent, readable by anyone. | Never | |
| 8069 | tcp | Odoo | Odoo ERP web service.Real business app: TLS in front, patched, strong master password. | Care | |
| 8080 | tcp | HTTP alt / proxy | The classic alternate web port — Tomcat, Jenkins, proxies.Fine for a real service behind a reverse proxy; a naked Jenkins or an open proxy here is a takeover. | Care | |
| 8081 | tcp | HTTP alt / Nexus | Second alternate web port; Sonatype Nexus default.An artifact repository is a supply-chain asset — authenticate it. | Care | |
| 8086 | tcp | InfluxDB | InfluxDB HTTP API.Time-series data and, in 1.x, no authentication by default. | Never | |
| 8088 | tcp | Hadoop YARN | YARN ResourceManager UI and REST API.The unauthenticated REST API accepts job submissions — cryptominers automate this. | Never | |
| 8089 | tcp | Splunk management | Splunk’s management API.Administrative access to your log platform. | Never | |
| 8090 | tcp | Confluence / HTTP alt | Atlassian Confluence default.Repeatedly hit by pre-auth RCE — patch fast or keep it internal. | Care | |
| 8091 | tcp | Couchbase | Couchbase cluster management UI.Administrative access to the data. | Never | |
| 8096 | tcp | Jellyfin / Emby | Media server web UI.Reverse-proxy it with TLS and real accounts. | Care | |
| 8098 | tcp | Riak HTTP | Riak’s HTTP interface.Direct data access. | Never | |
| 24800 | tcp | Synergy / Barrier | Shared keyboard and mouse between machines.Unencrypted keystrokes — including passwords. | Never | |
| 28015 | tcp | RethinkDB | RethinkDB client driver port.No authentication in the default configuration. | Never | |
| 28017 | tcp | MongoDB HTTP status | Legacy MongoDB status page.Leaks database and server internals without a login. | Never | |
| 47808 | udp | BACnet | Building automation — HVAC, lifts, access control.Unauthenticated control of the building itself. | Never |
http://host:port/ and times it. A connection that is established proves a socket is open; an instant refusal usually means nothing is listening; anything else is honestly reported as “can't tell”. Each attempt gives up after 2.5s.nc -vz example.com 443
nmap -Pn -p 443 example.com
telnet example.com 443
curl -v --max-time 5 telnet://example.com:443
This page cannot answer that, and neither can any other page — from your browser. Opening a TCP connection to an arbitrary host and port is not something JavaScript is allowed to do. Every “open port checker” that gives you a green tick is running the scan on their server. Which is fine, as long as you know what you are agreeing to: they learn which host and port you were worried about, and the answer they give you is about the route from their data centre — not from the internet as your users see it.
What to do instead
Run the check from outside your own network. Copy an nmap or nc line from the card above and run it from a machine that is not behind the same router — a phone on mobile data with a terminal app, a cheap VPS, a colleague's laptop. Running it from inside the LAN tests the LAN, not the internet, and will happily say “open” while the world sees nothing.
Then check the thing that is actually blocking it, in this order: the service is bound to0.0.0.0 and not 127.0.0.1 · the host firewall (ufw, firewalld, Windows Defender Firewall) · the cloud security group or the router's port-forward rule · and finally your ISP, which commonly blocks 25, 80 and 445 on residential lines whatever you configure.
What a browser genuinely can verify
One thing: that an HTTPS service answers. If what you actually want to know is “is my site up and how fast is it”, the latency test measures real round trips to a CORS-open URL. If the name doesn't resolve, or resolves somewhere unexpected, that is a DNS problem, not a port problem — and it is the more common cause of “my port is closed” than an actual firewall.
An IP address finds the machine; a port picks which program on it gets the traffic. TCP sets up a connection first — a handshake, ordered delivery, retransmission — which is why the web, email and SSH use it. UDP just sends the packet with no handshake and no guarantee it arrives, which is why DNS, video calls and games use it: late data is worse than lost data.
That difference is why a UDP port is so much harder to test. TCP either completes a handshake or it doesn't, so a tool can tell you. A UDP service that has nothing to say to an unexpected packet stays silent — and silence looks identical to a firewall dropping it.
The three ranges
0–1023Assigned by IANA to core services. On Unix, binding one needs root (or CAP_NET_BIND_SERVICE).1024–49151Registered by vendors for their applications. Any user can bind these — which is why every dev server lives here.49152–65535Never assigned. The OS hands these out as the SOURCE port of your outgoing connections. (Linux actually uses 32768–60999 by default.)Closed is not the same as filtered
Closed means the host answered: the packet arrived, nothing is listening, and you got an immediate refusal (a TCP RST). Filtered means nothing answered at all — a firewall dropped your packet in silence, so you wait for a timeout and learn nothing. The difference matters: closed proves the host is reachable and the port is free; filtered tells you only that something between you and it is discarding traffic.nmap reports the two separately. A browser cannot distinguish them, which is why this page reports a timeout as “can't tell” rather than guessing.
The one habit worth keeping
Bind services to 127.0.0.1 instead of 0.0.0.0 unless something outside the machine genuinely needs them, and reach them over SSH or a VPN. Every database on the never-expose list above ships with that advice, and the leaks all begin the same way: a default bind address, a cloud instance with a public IP, and a scanner that found it within the hour.
The blocked-port list this page uses is the WHATWG Fetch Standard's “bad port” table — the ports every browser refuses to connect to (Chrome calls it ERR_UNSAFE_PORT). Local probing is additionally gated by Chrome's Local Network Access permission, which replaced Private Network Access and ships in Chrome 142.
FAQ
Can I close port 80 completely?
Yes, if you accept that http:// links to your site fail instead of redirecting, and if your certificates renew via DNS-01 rather than HTTP-01. Most sites keep 80 open serving nothing but a redirect, which is the better trade.
Is it safe to have port 80 open?
The port itself is fine — it is public by design. The risk is what you serve on it. A login page, an admin panel or an API on plain HTTP exposes credentials to anyone on the network path, including every intermediate hop.
What does HSTS do about port 80?
It tells the browser to rewrite http:// to https:// for your domain before any request is sent, so after one HTTPS visit the browser never touches port 80 again. It protects returning visitors; the first visit still needs the redirect, which is why 80 stays open.