Should I close port 80 on my web server?

Usually not. Keep port 80 open but make it do one thing: permanently redirect (301) every request to the HTTPS version. Closing it breaks visitors who type your address without https, and Let's Encrypt's standard HTTP check needs port 80 to renew certificates.

How do I check if HTTP redirects to HTTPS?

Run curl -I http://yourdomain.com. A 301 or 308 status with a Location header starting with https:// means the redirect works. A 200 status means the page is being served over plain HTTP.

Is port 80 open a security risk?

On a website that redirects to HTTPS, it is low risk. It becomes a problem when pages or logins are served over plain HTTP, or when port 80 belongs to a router, camera or printer admin page that should not be reachable from the internet at all.

Low risk Port 80 · HTTP

Port 80 is open: how to redirect HTTP to HTTPS

By Stephane Meus, CEH, PenTest+ · Updated 17 October 2026 · 5 minute read

Short answer: port 80 is plain, unencrypted HTTP. On a website, having it open is normal, as long as it does nothing except send visitors to the HTTPS version of the same page. The problem is when pages, forms or logins are actually served over HTTP, where anyone on the same network can read or change them.

The fix: get a free certificate, turn on HTTPS, and make port 80 answer every request with a permanent (301) redirect to https://. If port 80 belongs to a router, camera or printer instead of a website, close it.

What is port 80?

Port 80 is the default port for HTTP, the original web protocol. HTTPS, the encrypted version, uses port 443. When someone types yourcompany.com without https://, their browser often tries port 80 first. That is why most websites keep it open: to catch those visitors and send them to HTTPS.

FreshScanSentry flags every open port 80 as Low so you can confirm it only redirects. The scan doesn't assume the worst; it asks you to check.

When it's a problem

Pages load over plain HTTP. On public Wi-Fi or a compromised router, anyone in the path can read what visitors send, including passwords and form data, and can inject content into the page.
Browsers warn your visitors. Chrome, Edge, Firefox and Safari mark HTTP pages "Not secure", especially pages with forms. That costs trust and sales.
Search ranking. Google has used HTTPS as a ranking signal since 2014.
It's not a website at all. Port 80 open on your office IP address often means a router, camera, printer or NAS admin page is reachable from the internet. Those are attack targets in their own right.

How it looks in your report your-site.com

80 HTTP Unencrypted; check it redirects to HTTPS Low

Fine when it only redirects to HTTPS

How to check

Test the redirect from any computer:
```
curl -I http://yourcompany.com
```
You want a 301 (or 308) status and a Location: line starting with https://. A 200 means the page is served over plain HTTP. Test www. too, and a page deeper in the site.
Or just open it in a browser. Type http://yourcompany.com and watch the address bar. It should switch to https:// by itself.
If the scan was of your office IP address, open http://your-public-ip from outside the office (a phone on mobile data works). If a router, camera or printer login page appears, see "Not a website" below.

Only scan addresses you own or have written permission to test.

How to fix it

1. Get a certificate

Most hosting companies include a free certificate: look for "SSL", "Let's Encrypt" or "AutoSSL" in your control panel. On your own server, Certbot gets one from Let's Encrypt and can set up the redirect for you:

sudo certbot --nginx     # or: sudo certbot --apache

2. Redirect port 80 to HTTPS

Platform	Setting
nginx	`server { listen 80; server_name yourcompany.com www.yourcompany.com; return 301 https://$host$request_uri; }`
Apache	In the `<VirtualHost *:80>` block: `Redirect permanent / https://yourcompany.com/`
IIS	Install the URL Rewrite module and add a rule that redirects HTTP to `https://{HTTP_HOST}/{R:1}` with a permanent (301) redirect
Cloudflare	SSL/TLS → Edge Certificates → Always Use HTTPS: on
cPanel hosting	Domains → Force HTTPS Redirect: on
WordPress	Settings → General: both addresses start with `https://`, plus the host's redirect setting above

3. Tell browsers to always use HTTPS

Once the redirect works, add an HSTS header so returning visitors skip HTTP entirely. The HSTS guide has settings for each platform.

4. Re-scan to confirm

Port 80 will still show as open, which is expected. Your curl -I check should now return a 301 to HTTPS.

Not a website? Close it

If port 80 on your office IP address leads to a router, camera, printer or NAS login page:

On the router, turn off remote management (sometimes called "web access from WAN").
Remove any port forwarding rule for port 80 that points to a device inside.
Change the device's default password, and install its firmware updates.
If someone needs remote access to the device, use a VPN instead.

What not to do

Don't close port 80 on a website just to clear the finding. Visitors who type your address without https:// may get an error, and Let's Encrypt's standard HTTP check uses port 80 to renew certificates.
Don't use a temporary (302) redirect. Use 301, so browsers and search engines remember the HTTPS address.

Common questions

Our site already has the padlock. Why is port 80 flagged?

Because port 80 still answers. If your curl -I check shows a 301 to HTTPS, you're done: the finding is informational for you.

Do I need to pay for a certificate?

No. Let's Encrypt certificates are free and trusted by all major browsers. Paid certificates only add things like organization validation, which most small businesses don't need.

We use a website builder (Wix, Squarespace, Shopify).

They handle HTTPS and the redirect for you. Make sure it's switched on in the site's domain or SSL settings.

Sources: Let's Encrypt challenge types · Certbot · Google: HTTPS as a ranking signal · nginx return directive · Apache: simple redirection