TCP Port 80 – HTTP (Hypertext Transfer Protocol)

Port 80 is the original port for HTTP, the Hypertext Transfer Protocol that web browsers and web servers use to exchange web pages, images, scripts, and other content. When a browser loads a URL beginning with http://, it connects to TCP port 80 on the server and sends an HTTP request; the server responds with the requested resource. The protocol has been in use since 1991, the year Tim Berners-Lee released the World Wide Web, and is currently specified in RFC 9110 (2022).

Port 80 was the dominant web port for most of the internet’s history, but its share of real web traffic has fallen sharply since the mid-2010s. After Google began using HTTPS as a search ranking signal in 2014, after browsers started flagging unencrypted HTTP pages as “Not Secure,” and after Let’s Encrypt made TLS certificates free and automated, almost all consumer web traffic moved to HTTPS on port 443. Most modern web servers configured for port 80 today simply redirect incoming connections to the HTTPS version of the same URL, completing the request encrypted on port 443.

Port 80 still sees real use in a few specific contexts. Internal-only services on a private network sometimes run plain HTTP, since there is no internet path to intercept the traffic. Embedded device administration interfaces (network printers, older home routers, industrial equipment) often expose plain HTTP for local configuration. Captive portal pages on public Wi-Fi networks rely on HTTP redirects on port 80 to push users into the login page before granting full network access.

Outbound TCP/80 from end-user devices is normal, though increasingly rare in absolute terms compared to TCP/443. Inbound TCP/80 to a host that is not a web server, redirector, or captive portal is uncommon and worth investigating.

About TCP Port 80

Port 80 carries the IANA assignment for http. The IANA description reads: ‘World Wide Web HTTP’.

Security Considerations

Port 80 has the longest and broadest attack history of any port covered here. Two decades of web vulnerabilities, server bugs, and malware delivery channels run through it. Port 80 carries by far the largest IDS rule count in this dataset, and the web-application-attack and web-application-activity classtypes lead the mix.

Several distinct threat patterns dominate. The first is direct attacks against web applications: SQL injection, cross-site scripting, directory traversal, command injection, and authentication bypass attempts targeting CMS platforms, web admin interfaces, and custom web apps. Sample rules in our dataset cover decades of such attempts, from late-1990s CGI exploits through modern web framework vulnerabilities. The second is malware command-and-control over plain HTTP, which was once the dominant C2 channel before HTTPS displaced it. The third is malware download and exploit kit traffic, where a compromised page or malicious ad delivers a payload to a vulnerable browser.

Our dataset names many specific malware families with port 80 activity, including Zeus, Emotet (MITRE S0367), the Cobalt Strike framework (S0154), the historic Conficker worm (S0608), and the ZeroAccess botnet (S0027). The presence of older threats like Conficker reflects the long lifetime of port 80 attack rules; the rules for these families remain useful for detecting infections on unpatched legacy systems.

Modern defenses have shifted accordingly. Web application firewalls (WAFs) inspect HTTP traffic for attack patterns and have become a standard layer in front of any internet-facing web service. Most organizations now redirect plain HTTP to HTTPS at the edge, reducing port 80 to a redirect responder rather than a content-serving endpoint, which dramatically narrows the attack surface visible on this port. Browser-level changes (mixed-content blocking, automatic HTTPS upgrades, deprecation of plain-HTTP features) reduce the number of legitimate scenarios in which a user’s browser sends sensitive data over port 80 at all.

Inbound TCP/80 traffic to a host that is not a designated web server or redirector is uncommon and worth investigating. Outbound TCP/80 from an end-user device to unfamiliar destinations, particularly with consistent timing patterns or unusual user agents, is a classic indicator of older malware command-and-control and is still detected by many endpoint and network monitoring products today.

IDS Rule References

2081 IDS / security rules reference TCP port 80. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.

Rule categories (top 6): trojan-activity (750), web-application-activity (476), web-application-attack (344), attempted-recon (271), misc-activity (76), attempted-user (59).

Sample rule descriptions for TCP port 80:

• BROWSER-OTHER Netscape 4.7 client overflow
• BROWSER-OTHER Netscape 4.7 unsucessful overflow
• SERVER-WEBAPP PCCS mysql database admin tool access
• INDICATOR-SCAN cybercop os probe
• SERVER-WEBAPP HyperSeek hsx.cgi directory traversal attempt

Malware Rule References

A meaningful share of the IDS rules that reference this port are malware related.

716 of the 2081 IDS rules that reference TCP port 80 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.

Families observed (top 8): Bancos (20), Zeus (18), Fareit (15), Symmi (13), DesertFalcon (11), Zebrocy (11), Chopper (10), Locky (9), and 278 more families.

Checking Port 80 on Your Own Connection

On a home computer that is not running a web server, port 80 should test closed, and that is the result you want. If you are hosting something and the port needs to be reachable, see how to check if port 80 is open for a step-by-step check from your computer, your local network, and the outside world.

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).