Port 80 HTTP – Free, Online, Private

What listens on 80

Port 80 is HTTP without TLS. The IANA name is http, World Wide Web HTTP, cited to RFC 9110. A browser that is given a URL with no port and the scheme http connects here. The same number is where an HTTPS site still listens so it can redirect to port 443. IANA also records UDP and SCTP rows and a duplicate service name www. The web you run is TCP. Nothing about port 80 implies a particular application server. nginx, Caddy, Apache, and a load balancer all bind it the same way. The Host header, not the port, picks the site.

The IANA service name is http: World Wide Web HTTP. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 80. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 80

Service notes for port 80: the IANA name is http (World Wide Web HTTP), and the program people mean is HTTP. TCP 80 is the IANA http port. Browsers use it for cleartext HTTP and for the redirect onto HTTPS. Cleartext HTTP can be read and changed on the path. Use it to redirect to HTTPS and to answer the ACME HTTP-01 challenge, and do not serve the application there. A listener that returns the real site on 80 will be used. HSTS tells browsers to stop trying 80, after they have seen the header once. An open proxy on 80 is a different and worse bug. If this host is not a web edge, 80 should be closed. Development servers do not belong on 80 on a reachable address. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 80, you are on the wrong page.

A process already bound to 80 is why a new proxy will not start. ss shows it. On Linux it may be an old nginx, or a privileged helper. A second failure is a redirect loop: 80 sends people to HTTPS, and 443 sends them back, often because the proxy sees the wrong scheme behind a load balancer. A third is binding 80 inside a container and forgetting to publish it, so ss on the host shows nothing and the container thinks it is serving. Check the namespace you think you configured.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 80 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. A public site should accept TCP 80 on the edge and answer, even if the only answer is a redirect. Connection refused means nothing is listening. A timeout means a filter. curl -I http://host/ shows the status line. nc only shows that TCP completed.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• UDP 80 is in the registry and is not how browsers fetch a page.
• Port 8080 is http-alt, not a synonym the browser will try on its own.
• A redirect to HTTPS still requires 80 to be open if you want that redirect to work.
• ACME HTTP-01 uses port 80. Closing it breaks issuance unless you use another challenge.

Linuxsudo ss -lptn 'sport = :80'
sudo lsof -nP -iTCP:80 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:80 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.80[^0-9]'

Windowsnetstat -ano | findstr :80
Get-NetTCPConnection -LocalPort 80

Remotenc -vz host 80