80

Port 80/tcp is the IANA-assigned home of HTTP and, by nmap-services frequency, the single most commonly open TCP port on the internet. HTTP is the stateless request/response protocol of the World Wide Web — methods, header fields, and status codes carried over TCP — with HTTP/1.1 specified in RFC 9112, HTTP/2 in RFC 9113, and cross-version semantics in RFC 9110. In 2026 the principal *legitimate* role of plaintext port 80 is to issue an HTTP 301 redirect to HTTPS on 443 and to serve the ACME HTTP-01 challenge during certificate issuance; browsers increasingly treat plaintext HTTP as hostile (Chrome's "HTTPS-First" rollout). The IANA registry is unusually layered here: the canonical name is http ("World Wide Web HTTP", reference RFC 9110), alongside an alias www that the registry explicitly flags as a duplicate "not to be used for discovery purposes," and the original www-http entry whose registry contact is Tim Berners-Lee and whose reference field is blank. For an analyst, an open 80/tcp means a web server or a redirect — the useful steps are fingerprinting the server/app and version, checking whether it redirects to HTTPS, and scanning the web application for vulnerabilities. Because the traffic is unencrypted, it is exposed to eavesdropping, credential sniffing, and on-path content injection, and HTTP beaconing is a frequent hiding place for command-and-control.

IANA assignment

http — "World Wide Web HTTP"; reference [RFC9110] (modified 2021-10-01). Aliases at port 80: www (registry: duplicate of http, not for discovery) and legacy www-http (contact Tim Berners-Lee, reference blank) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 0.484143 — the single most common open TCP port [Well-established] — nmap-services file

Related ports

443 HTTPS; 8080 HTTP-alt; 8000

Primary use

unencrypted web traffic; in 2026 chiefly a 301 redirect to HTTPS and ACME HTTP-01 challenge hosting

Other/unofficial uses

forward/reverse proxies, REST API endpoints, captive portals, HTTP-based C2

Security implications

no encryption (eavesdropping, credential sniffing, on-path tampering/injection); web-app vulnerability surface (injection, XSS, server/app RCE); HTTP C2 beaconing hides in ordinary requests

Typically seen on

web servers, load balancers, IoT/embedded admin interfaces, routers

Analyst note

Open 80/tcp means a web server or a redirect. Fingerprint the server/app and version, check for an HTTPS redirect, and scan the web app for vulnerabilities.

Port 80/udp is registered with IANA under the service name http, description "World Wide Web HTTP," assignee [IESG], contact [IETF_Chair], and reference [RFC9110] (HTTP Semantics) — a registration that mirrors the far more famous 80/tcp assignment; port 80 is dual-registered on both transports. In practice the UDP slot is essentially dead weight. No mainstream web server, application, or protocol actively listens on UDP port 80, and there is no plaintext HTTP-over-UDP. The assignment exists primarily as a reservation: IANA historically dual-claimed well-known port 80 across TCP and UDP, and the UDP half is retained to prevent a conflicting claim on a recognizable number rather than to carry traffic. The common point of confusion is HTTP/3, which does run over UDP via QUIC — but exclusively on 443/udp, never 80/udp, and with TLS 1.3 mandatory (there is no cleartext HTTP/3). For an analyst, UDP/80 is not a meaningful attack surface on its own: a UDP probe to port 80 typically draws ICMP port-unreachable or silence, indicating nothing is listening. Threat tooling that flags "port 80" almost always means TCP/80; UDP/80 hits in broad UDP sweeps are most likely misrouted probes, spoofed packets, or firewall tests rather than service exploitation. Blocking unused UDP ports including UDP/80 at the perimeter is low-stakes and harmless. The registry also carries two duplicate aliases on 80/udp — www and www-http — both flagged as not for use in service discovery; the www-http row lists original assignee Tim Berners-Lee and carries no recorded registration date or reference (left blank in the registry, and left blank here).

IANA assignment

http — "World Wide Web HTTP"; assignee [IESG]; contact [IETF_Chair]; reference [RFC9110]; dual-registered 80/tcp + 80/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

well-known (0–1023)

Registration date

blank in registry (no value recorded for the http row) [Confirmed] — IANA CSV (registration_date column empty)

Modification date

2021-10-01 [Confirmed] — IANA CSV (modification_date column)

Assignment notes

defined TXT keys for the assignment — u=<username> p=<password> path=<path to document> [Confirmed] — IANA CSV

Primary use

none in practice — an IANA reservation mirroring 80/tcp; no known service listens on UDP/80

Common software

none known on UDP/80 as of 2026

Exposure & scanning

not a meaningful attack surface on its own; UDP probes draw ICMP port-unreachable or silence; "port 80" in threat contexts almost always means TCP/80; UDP/80 hits are likely misrouted/spoofed probes or firewall tests

Duplicate aliases

www (80/udp, same IESG/IETF_Chair assignee, RFC9110, modified 2021-10-01, marked "should not be used for discovery"); www-http (80/udp, original assignee Tim Berners-Lee, no registration/modification date or reference recorded — blank stays blank) [Confirmed] — IANA CSV

HTTP/3 / QUIC clarification

HTTP/3 runs over QUIC (UDP) but exclusively on 443/udp, not 80/udp; no cleartext HTTP/3 (TLS 1.3 mandatory) [Confirmed] — Wikipedia HTTP/3; F5 QUIC/HTTP3 glossary; Caddy discussion

Security recommendation

negligible active risk; block unused UDP ports including UDP/80 as standard perimeter practice; no CVEs target UDP/80 as a distinct surface (separate from the substantial TCP/80 web attack surface) [Likely] — 42Gears blocking-port-80 article; Caddy discussion

Analyst note

treat UDP/80 as an unused reservation; any observed traffic warrants a benign explanation (misroute, spoof, sweep) before any service hypothesis.