Port 80 (HTTP)
Unencrypted web traffic.
- Transport
- TCP
- Internet exposure
- Public by design
Normally public, but keep the software patched and hardened.
Security notes
- Traffic, including cookies and form data, can be read and changed in transit; redirect to HTTPS.
- The most scanned port on the internet: expect constant probing for vulnerable web apps.
- Malware often uses plain HTTP for command and control because it blends in.
When it shows up in your logs
Inbound requests for paths like /wp-login.php, /.env or /phpmyadmin are automated scanning. Outbound HTTP to raw IP addresses is suspicious.