Port 80: HTTP

What uses port 80

Browsers connect to port 80 when a URL starts with http:// and has no port. Today port 80 mostly exists to redirect visitors to HTTPS on 443, and to answer Let’s Encrypt HTTP-01 challenges at /.well-known/acme-challenge/. On Linux, ports below 1024 need root or the CAP_NET_BIND_SERVICE capability, which is why apps usually listen on 3000 or 8080 behind a reverse proxy.

Should port 80 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

• Redirect all HTTP to HTTPS with a 301, and consider an HSTS header so browsers skip port 80 entirely on later visits.
• bind: permission denied on port 80 means the process isn’t root. Use a reverse proxy, setcap cap_net_bind_service=+ep on the binary, or net.ipv4.ip_unprivileged_port_start=80.
• address already in use usually means Apache, nginx or IIS is already running. Find it with sudo lsof -i :80.

Check what is listening on port 80

sudo ss -ltnp 'sport = :80'

sudo lsof -nP -iTCP:80 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 80 -State Listen
netstat -ano | findstr :80

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 80

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:80 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 80 -State Listen).OwningProcess

Open port 80 in the firewall

sudo ufw allow 80/tcp
# Close it again:
sudo ufw delete allow 80/tcp

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "HTTP 80/TCP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 80 with Docker

docker run -d -p 80:80 nginx

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 80 from another machine

nc -zv example.com 80

Test-NetConnection example.com -Port 80

Related ports

• Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.
• Port 8080 (HTTP alternate): the most common alternate HTTP port, used by proxies, app servers and dev tools.
• Port 8000 (Development server (Django, Python)): a common port for development servers, including Django and Python’s http.server.
• Port 3000 (Development server / Grafana): the default port of many development servers and of Grafana.

More web ports

8443 (HTTPS alternate) . See all ports in the port lookup.

Sources

• IANA port registry: 80

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions