443
Summary
- // if you see it open
- TLS implementation flaws (Heartbleed 2014; POODLE 2014), deprecated protocol versions (SSL 2.0 per RFC 6176; SSL 3.0 per RFC 7568; TLS 1.0/1.1 per RFC 8996), and expired/misissued certificates. Encryption blinds passive inspection, so encrypted C2 beaconing (e.g., Cobalt Strike) hides well on 443.
- // common applications
- NginxApacheCaddyIISCloudflareHAProxy
- // analyst note
- Open 443/tcp means a TLS-protected web service. Enumerate TLS versions/ciphers, examine the certificate (validity, issuer, SAN), test for known TLS vulnerabilities, and identify the underlying web app.
About port 443/tcp.
Port 443/tcp is the IANA-assigned home of HTTPS — HTTP carried inside a TLS session — and is the default secure transport of the web. TLS supplies confidentiality, integrity, and server authentication via a handshake that negotiates the protocol version and cipher suite, establishes session keys, and validates an X.509 certificate; the current versions are TLS 1.2 (RFC 5246) and TLS 1.3 (RFC 8446). Adoption is now near-universal: W3Techs reported in January 2026 that 92.6% of the top 100,000 sites default to HTTPS, and Google's Chrome transparency reporting (October 2025) put HTTPS at over 95% of desktop and over 99% of Android page loads. The IANA service name is https ("http protocol over TLS/SSL", reference RFC 9110), assigned to the IESG/IETF Chair. For an analyst, an open 443/tcp means a TLS-protected web service, and the high-value triage steps are enumerating supported TLS versions and cipher suites, examining the certificate (validity window, issuer, SAN), testing for known TLS flaws, and identifying the underlying application. The same encryption that protects users also blinds passive inspection, so encrypted command-and-control (e.g., Cobalt Strike) hides well on 443. Historically relevant weaknesses cluster in TLS *implementations* and deprecated versions — Heartbleed and POODLE (both 2014), and the formal deprecation of SSL 2.0/3.0 and TLS 1.0/1.1.
- IANA assignment
https— "http protocol over TLS/SSL"; reference [RFC9110] (modified 2021-10-01); assignee IESG/IETF Chair [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.208669 (third-most-common open TCP port in classic rankings) [Well-established] — nmap-services file
- Related ports
- 80 HTTP; 443/udp (HTTP/3 QUIC); 8443 HTTPS-alt
Primary use
encrypted web traffic (HTTP over TLS); the default secure web transport. ~92.6% of top-100k sites default to HTTPS (W3Techs, Jan 2026)
Other/unofficial uses
SSL-VPN endpoints, API gateways, encrypted C2, tunneling over 443 to bypass egress filtering
Security implications
TLS implementation flaws (Heartbleed 2014; POODLE 2014); deprecated versions (SSL 2.0 per RFC 6176, SSL 3.0 per RFC 7568, TLS 1.0/1.1 per RFC 8996); expired/misissued certs. Encryption blinds passive inspection, so encrypted C2 beaconing hides on 443
Typically seen on
web servers, CDNs, load balancers, VPN endpoints, cloud services, IoT
- Analyst note
- Open 443/tcp means a TLS-protected web service. Enumerate TLS versions/ciphers, examine the certificate (validity, issuer, SAN), test for known TLS vulnerabilities, and identify the underlying web app.
About port 443/udp.
Port 443/udp is the de-facto default for HTTP/3 over QUIC, mirroring the HTTPS-over-TCP convention on 443/tcp. IANA registers UDP/443 under the same https service name (reference RFC 9110), and the HTTP/3 default-port convention itself is documented in RFC 9114 and RFC 9308 ("the default port for HTTP/3 is UDP port 443"). QUIC (RFC 9000) is a UDP-based, multiplexed, secure transport that integrates the TLS 1.3 handshake (RFC 9001), provides per-stream flow control to eliminate TCP head-of-line blocking, sets up connections in 1-RTT or 0-RTT, and supports connection migration across network changes; HTTP/3 (RFC 9114) maps HTTP semantics onto it, with clients typically discovering HTTP/3 via the Alt-Svc header and the ALPN token h3. The security and operational catch is that QUIC encrypts almost the entire transport header, which blinds traditional firewalls, middleboxes, and deep packet inspection and complicates troubleshooting — and if UDP/443 is blocked, clients silently fall back to HTTP/2 over TCP, masking transport failures. For an analyst, an open 443/udp suggests QUIC/HTTP-3 support; the practical steps are confirming it with a QUIC-capable client (e.g., curl --http3-only), verifying the traffic is legitimate web service, and ensuring monitoring covers UDP/443 and not just TCP/443. A common hardening stance where legacy inspection is required is to block or application-ID-filter QUIC so traffic falls back to inspectable TCP.
- IANA assignment
https— "http protocol over TLS/SSL"; reference [RFC9110] (same registry row covers UDP/443). HTTP/3 default-port convention documented in RFC 9114/9308 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- large and growing share of web traffic — Cloudflare reported HTTP/3 grew from ~23% (May 2022) to ~30% of requests (Aug–Sep 2022) [Well-established] — Cloudflare "Examining HTTP/3 usage one year on" (June 2023). nmap-services observed open-frequency 443/udp ≈ 0.01084 — low in absolute terms (~1 in 100 sampled hosts) but 64th of 5,615 UDP entries, against ≈ 0.208669 for 443/tcp (~21 in 100), the gap you would expect while HTTP/3 rides alongside rather than replaces HTTPS-over-TCP[Likely] — nmap-services dataset
- Related ports
- 443/tcp HTTPS; 80 HTTP
Primary use
HTTP/3 over QUIC — UDP-based encrypted web transport; the de-facto default port for HTTP/3
Other/unofficial uses
other QUIC-based protocols (DoQ per RFC 9250 on its own port; WebTransport); general-purpose QUIC apps
Security implications
QUIC encrypts nearly the entire transport header, blinding firewalls/middleboxes/DPI and complicating troubleshooting; blocking UDP/443 causes silent fallback to HTTP/2 over TCP; higher server CPU cost (~2–4× vs TCP, per Cloudflare/Google); can carry encrypted C2
Typically seen on
CDNs (Cloudflare, Google), modern web servers (NGINX ≥1.25, Caddy), and current browsers (Chrome/Edge 87+, Firefox 88+, Safari 16+) with HTTP/3 enabled by default
- Analyst note
- Open 443/udp suggests QUIC/HTTP-3. Confirm with a QUIC-capable client, verify legitimate web service, and ensure monitoring covers UDP/443 — not just TCP/443.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| https | TCP | secure http (SSL) | 20.87% |
| https | UDP | — | 1.08% |
| https | SCTP | http protocol over TLS/SSL | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.