Port 80 — HTTP

Q: How do I check if port 80 is open?

Locally, sudo lsof -i :80 on macOS or Linux, or netstat -ano | findstr :80 on Windows. From outside, nc -zv host 80 tells you whether anything answers.

TCP well-known

What runs on port 80

Unencrypted web traffic. Still the default port a browser tries when no scheme is given.

Plain HTTP. The only thing that should be served here now is a permanent redirect to HTTPS, and even that is a transitional measure: with HSTS the browser stops trying port 80 at all after its first visit. Port 80 remains useful for the ACME HTTP-01 challenge that Let's Encrypt uses to issue certificates, which is the usual reason it cannot simply be closed.

Security considerations

Serve nothing here but a 301 redirect to HTTPS. Add HSTS so browsers stop trying port 80 at all.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :80
sudo ss -lntp | grep :80

# Windows
netstat -ano | findstr :80
Get-NetTCPConnection -LocalPort 80

# is it reachable from outside?
nc -zv example.com 80
curl -v telnet://example.com:80

Freeing the port

# find the process, then stop it
sudo lsof -ti :80 | xargs kill        # Linux / macOS
netstat -ano | findstr :80            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Yes — that is what it is for. Make sure whatever is listening is something you intend to expose, and that it does nothing but redirect to HTTPS.

Opening or blocking port 80

This one is meant to be reachable, so the blanket rule is the normal answer and the narrow form under it is for the case where the service is internal-only:

# ufw — Debian, Ubuntu
sudo ufw allow 80/tcp
sudo ufw allow from 10.0.0.0/8 to any port 80 proto tcp   # if it only serves internally

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=80 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j DROP

# Windows
New-NetFirewallRule -DisplayName "HTTP 80" -Direction Inbound -Protocol TCP -LocalPort 80 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Port	80
Protocol	TCP
Service	HTTP
Range	Well-known (0–1023) — binding requires root on Unix

Frequently asked questions

What is port 80 used for?

Unencrypted web traffic. Still the default port a browser tries when no scheme is given.

Is it safe to open port 80?

Serve nothing here but a 301 redirect to HTTPS. Add HSTS so browsers stop trying port 80 at all.

How do I check if port 80 is open?

Locally, sudo lsof -i :80 on macOS or Linux, or netstat -ano | findstr :80 on Windows. From outside, nc -zv host 80 tells you whether anything answers.

Why do I get "address already in use" on port 80?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :80 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers