Port 80 · TCP

Port 80: HTTP

Unencrypted web traffic.

Protocol
TCP
On Windows
System (PID 4) when a Windows service uses the HTTP Server API
Risk if open to the internet
Medium

Seeing it on your PC

Browsers still use it for sites without HTTPS and for the first hop before a redirect. Windows and many apps also use plain HTTP on purpose for certificate revocation checks (CRL and OCSP) and some update downloads, which are signed instead of encrypted. A listener owned by System (PID 4) is http.sys, shared by IIS and other Windows services.

Should you block it?

Outgoing 80 is normal, so judge the program and the address rather than the port. Nothing should accept incoming connections on 80 unless you run a web server.

Check it on your PC

Run this in PowerShell to see what is using port 80 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 80 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound TCP 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.