Port 80: HTTP, redirects and ACME

Port 80 is the unencrypted HTTP port, today mainly used for redirects and ACME challenges.

Port: 80
Protocol: TCP
Service: HTTP
Exposure: Public: yes, for redirects and ACME

daniele@mikweb: ~/ports — less 80.md

Port 80 is the default HTTP port. Don't serve content here anymore, only a 301 redirect to HTTPS. With HSTS, browsers go straight to port 443 afterwards.

Keeping it open still makes sense: Let's Encrypt always validates HTTP-01 challenges over port 80 at /.well-known/acme-challenge/. If it is blocked, renewals fail – the alternative is the DNS-01 challenge.

Common errors: redirect loops behind a reverse proxy or load balancer because the backend ignores X-Forwarded-Proto, and ACME failures caused by a redirect rule that doesn't exclude the challenge path.

Check

curl -I http://example.com