Every web server listens on one or more ports, numbered doors on the server's IP address. Understanding web server ports explains why a browser reaches your site without typing a number, why some admin tools live on 8080 or 8443, and why a closed firewall port makes a site look "down". This guide covers the four ports you meet most with web servers.
Before you start
- Basic idea of IP addresses and TCP. If not, read TCP vs UDP ports and protocols first.
- SSH access to a Linux VPS if you want to run the checks.
How web server ports work
A connection is identified by four values: client IP, client port, server IP and server port. The client port is a random high number picked by the visitor's operating system; the server port is fixed and well known so clients know where to knock. A URL without a port uses the scheme's default: http:// means port 80, https:// means port 443. https://example.com:8443/ overrides that default.
Only one process can listen on a given IP and port at a time. If Apache owns port 80, Nginx cannot start on port 80 on the same address, and you get an "address already in use" error.
Port 80: plain HTTP
Port 80 carries unencrypted HTTP. Today its main jobs are:
- Redirecting to HTTPS. Visitors who type the bare domain arrive on port 80 and get a 301 to
https://. - Certificate validation. Let's Encrypt's HTTP-01 challenge fetches a file from
http://domain/.well-known/acme-challenge/on port 80, so closing it breaks automatic renewals that use that method.
Keep port 80 open, but serve nothing sensitive on it.
Port 443: HTTPS
Port 443 carries HTTP inside TLS. The TLS handshake happens first; the browser sends the hostname in the SNI field so the server can choose the right certificate before any HTTP is exchanged. HTTP/1.1 and HTTP/2 run over TCP 443. HTTP/3 runs over UDP 443 (QUIC), so a firewall that only opens TCP 443 silently forces browsers back to HTTP/2.
Port 8080: alternate HTTP
8080 is the traditional "second HTTP port". You will see it on:
- Backend application servers such as Tomcat, Jenkins or a Node.js app sitting behind a reverse proxy.
- Development servers and test instances.
- Setups where Nginx serves port 80 and passes requests to Apache on 8080.
Backends on 8080 should normally bind to 127.0.0.1 so only the local reverse proxy can reach them.
Port 8443: alternate HTTPS
8443 is the HTTPS counterpart of 8080. Admin panels and appliances often use it (Plesk, for example, serves its panel on 8443), as do Tomcat HTTPS connectors and services that must not clash with the main site on 443.
Summary table
| Port | Protocol | Typical use |
|---|---|---|
| 80/TCP | HTTP | Redirect to HTTPS, ACME HTTP-01 validation |
| 443/TCP | HTTPS (HTTP/1.1, HTTP/2) | All public website traffic |
| 443/UDP | HTTP/3 over QUIC | Faster connections on modern browsers |
| 8080/TCP | HTTP | Backends, app servers, dev instances |
| 8443/TCP | HTTPS | Admin panels, secondary HTTPS services |
Check which process uses a port
- List listening TCP and UDP sockets with the owning process:
sudo ss -tulpn | grep -E ':(80|443|8080|8443)\b' - Test from outside that the port answers:
curl -sI http://example.com/ ; curl -sI https://example.com/ - If a port does not answer, check the firewall (
ufw status,firewall-cmd --list-allor CSF) before blaming the web server.
More detail on socket tools is in checking open ports with ss and netstat.
Troubleshooting
- "Address already in use" on start: another web server or an old process holds the port. Find it with
ss -tlpnand stop or reconfigure it. - Site works on HTTP but not HTTPS: TCP 443 is blocked or nothing listens on it. Check the firewall and the server's
listen 443/Listen 443directive. - Ports below 1024 refuse to bind: on Linux only root (or a process with
CAP_NET_BIND_SERVICE) can bind them. Web servers start as root and drop privileges to worker users.
FAQ about web server ports
Can I run a website on a port other than 443?
Yes, but visitors must type the port in the URL and some corporate networks block unusual ports. Use 443 for anything public.
Should I close port 80 completely?
Usually no. Keep it open for redirects and certificate validation; HSTS then keeps returning visitors on HTTPS.
Is 8080 less secure than 80?
The number does not matter. What matters is what listens there and whether it is exposed publicly.
Do shared hosting users need to manage ports?
No. On MdmHost cPanel hosting the LiteSpeed web server already listens on 80 and 443 and the firewall is managed for you.