Port 443 (HTTPS): what it is, how it is attacked and how to secure it

Category hub: Ports, protocols and services

In one sentence: Port 443 is the network door for encrypted web traffic, and the padlock in your browser depends on it being set up and kept up to date properly.

What runs on this port

Port 443 carries HTTPS, which is ordinary web traffic wrapped in TLS, Transport Layer Security. The NCSC describes TLS as a protocol that provides security for digital communications between two parties.

Websites, web apps, APIs, customer portals, VPN gateways and remote access tools answer here. A certificate shows which site you are talking to, and encryption stops others on the network reading or changing the traffic.

Why attackers look for it

Almost every business with a website has port 443 open, so it is heavily scanned. Scans record which TLS versions each server offers and which software sits behind it, and device search engines publish the results.

Attackers care less about the padlock than about what is behind it. A login page, VPN portal or API on 443 is a way in if the software is old or the logins are weak.

How it gets attacked

Outdated TLS settings. The NCSC says all versions of SSL must be disabled, and TLS 1.0 and 1.1 should not be used.
Flaws in TLS software. The NCSC warns that implementation flaws can be exploited if updates are not applied promptly.
Expired certificates, which teach people to click through warnings.
Weak logins and old software behind the encryption. HTTPS protects traffic in transit. It does not fix a bad password.

A real example is Heartbleed, CVE-2014-0160. A bug in OpenSSL 1.0.1 to 1.0.1f let an attacker read private memory from a server, 64 kilobytes at a time. US-CERT said this could expose credentials and secret keys. OpenSSL 1.0.1g fixed it. The bug was in one library, not in the TLS protocol itself.

Who it affects and how badly

Sole trader to 10 staff. Your host usually runs TLS for you. Worst case: an expired certificate and a day of lost customers.
10 to 250 staff. Self-managed servers, VPN gateways and portals need patching. One flaw can hand over passwords or a route into the office network.
250 plus and regulated firms. Banks, fintech, insurers, telecoms and healthcare run many TLS endpoints. A weak setting can fail an audit, and a stolen key can force every certificate to be replaced.

SaaS start-ups and MSPs should treat TLS settings on client portals as part of the service.

How to check whether yours is exposed

List every service that answers on 443, including VPNs, APIs and admin consoles.
Check each certificate’s expiry date and the names it covers.
Ask your IT provider which TLS versions each service accepts.
Run the free web vulnerability scan on your public sites.

How to secure it

Use the NCSC recommended TLS profiles, and plan a move to TLS 1.3 if you run TLS 1.2.
Disable all versions of SSL and TLS 1.0 and 1.1.
Keep web servers, VPN gateways and TLS libraries patched.
Turn on HTTP Strict Transport Security and mark cookies as secure.
Monitor certificate expiry and renew early, ideally automatically.
Put MFA on every login reachable through 443.
Close 443 on anything that does not need to be public.

Related terms

Port 80 (HTTP)
Port 8080/8443 (alternative web)
TLS (Transport Layer Security)
HTTP Strict Transport Security
Certificate expiry
CVE

FAQ

Is HTTPS on port 443 enough to be secure?
No. It protects data in transit. Weak passwords and unpatched software behind it can still be attacked.

What was Heartbleed?
CVE-2014-0160, a bug in OpenSSL 1.0.1 to 1.0.1f that could leak server memory, including keys and credentials. OpenSSL 1.0.1g fixed it.

Which TLS versions does the NCSC say to avoid?
All versions of SSL, and TLS 1.0 and 1.1.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.