Port 80 has shrunk to a supporting role: almost every site answers on 80 only to redirect to HTTPS. It still matters for automatic certificate issuance (Let's Encrypt's HTTP-01 challenge needs it open) and for captive portals, which is why opening an http:// address brings up a hotel Wi-Fi login page.
Facts
- Port
- 80
- Protocols
- TCP
- Service
- HTTP
What uses port 80
Plain HTTP web traffic. Most sites only use 80 to redirect to HTTPS. Let's Encrypt validates certificates over port 80 (HTTP-01), captive portals intercept it, and some devices and old APIs still serve content on it.
On a Mac
Outgoing port 80 connections from a Mac are rare and worth noticing: captive-portal checks (captive.apple.com), certificate revocation checks (OCSP, CRL) and a few old apps. A local web server you run, such as Apache via Homebrew, may listen on 80.
sudo lsof -nP -iTCP:80Security
HTTP is unencrypted: anyone on the network path can read or change it. Never log in over plain HTTP.
Frequently asked questions
Is port 80 secure?
No. HTTP on port 80 is unencrypted, so it can be read or modified in transit. Use HTTPS on 443 for anything sensitive.
Should I close port 80 on my server?
Keep it open just to redirect to HTTPS and, if you use Let's Encrypt with HTTP validation, for renewals. Serve no content over it.
Why does my Mac connect to port 80?
Captive-portal detection, certificate checks (OCSP/CRL) and older apps. Check which app it is in LightAtom or with lsof.