Ports 80 and 443: HTTP vs HTTPS
Almost all web traffic rides on two ports: 80 for HTTP and 443 for HTTPS. The difference between them is the difference between a postcard and a sealed letter — one is readable by anyone on the path, the other is encrypted and authenticated. For a security-minded web, understanding these two numbers and how traffic moves between them is basic literacy.
What does each port carry?#
| Port | Protocol | Security |
|---|---|---|
| 80 | HTTP | None — plaintext, readable and modifiable in transit |
| 443 | HTTPS | HTTP over TLS — encrypted, authenticated |
On port 80, anyone on the network path can read the content and even alter it. On port 443, the same HTTP is wrapped in TLS, giving confidentiality, integrity, and server authentication. This is why “is it HTTPS?” is shorthand for “is this connection safe?”
Why keep port 80 at all?#
Only to get people onto 443. Users routinely type a bare domain, which defaults to http:// and
port 80 — creating a brief unencrypted moment an attacker could exploit with
SSL stripping. The standard pattern:
- Port 80 answers and immediately redirects to the
https://version. - HSTS then tells the browser to use HTTPS automatically on every future visit, closing even that first-request gap.
Ports 80 and 443 are where the web meets the network. More at the Network Security hub.
Frequently asked questions#
What is the difference between port 80 and port 443?
Port 80 is the default for HTTP — unencrypted web traffic, readable by anyone on the path. Port 443 is the default for HTTPS — HTTP secured with TLS, so the traffic is encrypted and the server authenticated. Modern sites serve on 443 and use 80 only to redirect visitors to the secure version.
Should you still run anything on port 80?
Only to redirect to HTTPS. Because users often type a bare domain that defaults to http://, port 80 needs to answer and immediately redirect to the https:// equivalent. Combined with HSTS, which tells browsers to use HTTPS automatically thereafter, this closes the brief unencrypted window at the start.