Port 80 (HTTP): what it is, how it is attacked and how to secure it

Category hub: Ports, protocols and services

In one sentence: Port 80 is the network door web servers use for ordinary, unencrypted pages, and it should normally only send visitors on to the secure version of your site.

What runs on this port

Port 80 is the standard door for HTTP, the plain way a browser asks a web server for a page. Websites, web apps, router login screens, printer admin pages and camera feeds can all answer here.

HTTP sends everything as readable text. The NCSC says TLS is the protocol that secures communications between two parties, and plain HTTP has none of it. Most public sites should keep port 80 open only to redirect visitors to HTTPS on port 443.

Why attackers look for it

Attackers do not pick you out. They scan every public internet address and record which ports answer. Search engines for devices, such as Shodan, publish what they find. One security vendor used Shodan to count more than 100,000 exposed Apache servers on a single vulnerable version after a flaw was published.

A server on port 80 often reveals its software and version, so attackers go straight for the old ones.

How it gets attacked

No encryption. Anyone on the network path, such as on public Wi-Fi, may be able to read or change HTTP traffic.
Outdated web server software with published flaws.
Misconfiguration, such as open directory listings and forgotten admin panels.
Default logins on routers and cameras.

A real example is CVE-2021-41773, a path traversal flaw in Apache HTTP Server 2.4.49. Path traversal means a request tricks the server into reading files outside the website folder. Apache said it was exploited in the wild. Rapid7 found that with a CGI module enabled it could allow remote code execution. The first fix was incomplete (CVE-2021-42013) and Apache 2.4.51 fixed both. Rapid7 Labs found roughly 65,000 potentially vulnerable servers exposed.

Who it affects and how badly

Sole trader to 10 staff. A brochure site on shared hosting is mostly your host’s job to patch. Worst case: a defaced site and lost enquiries.
10 to 250 staff. Estate agents, recruiters, construction firms and retailers often run their own server or a plugin-heavy site. A flaw can expose passwords and take orders offline.
250 plus and regulated firms. Fintech, insurers, healthcare and councils hold personal data. A web flaw can become a reportable breach with regulator attention.

The technology is the same in the UK, EU, US and Armenia.

How to check whether yours is exposed

List every public IP address and domain you own, including old test sites.
Find any firewall rule that allows inbound TCP 80, and record why.
Ask your host or MSP which web server and version each site runs.
Run the free web vulnerability scan on your public sites.

How to secure it

Redirect all HTTP traffic to HTTPS, and keep port 80 open only for that.
Turn on HTTP Strict Transport Security, which the NCSC recommends.
Patch the web server and plugins promptly. Apache 2.4.51 or later fixed the flaws above.
Close port 80 on any server that does not serve the public.
Keep admin pages behind a VPN or single sign-on with MFA.
Leave risky modules such as CGI off unless needed.
Remove unused sites and default pages.

Related terms

Port 443 (HTTPS)
Port 8080/8443 (alternative web)
SSL versus TLS
OWASP Top 10
CISA KEV
CVE

FAQ

Should port 80 be open on a public website?
Usually only to redirect visitors to HTTPS. The NCSC recommends HTTP Strict Transport Security so browsers stop using HTTP.

Why do attackers scan port 80?
Whole-internet scans find web servers quickly, and the software version helps attackers pick known flaws.

What was CVE-2021-41773?
A path traversal flaw in Apache HTTP Server 2.4.49 that Apache said was exploited in the wild. Version 2.4.51 fixed it and CVE-2021-42013.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.