Why Not To Use Port 80

“Choosing not to use Port 80 for your website could significantly improve your online security, as this common HTTP port is often targeted by hackers and can leave sensitive user information vulnerable to theft.”

Reason	Description
Security Concerns	Port 80 is unencrypted, making it prone to data breaches and security threats.
HTTP Only	Port 80 only serves HTTP requests. For HTTPS, port 443 is used which provides better security due to encryption.
Regulated by ISPs	Many ISPs block or regulate port 80 to prevent abuse by malicious actors.
Non Admin Users	On Unix systems, ports below 1024 can only be opened by processes with admin privileges. Using port 80 might necessitate launching your app as a superuser, thus exposing the system to potential risks.

The utilization of Port 80 for your applications or services comes with several drawbacks. First and foremost, there are substantial security concerns. Because Port 80 is unencrypted, it’s more vulnerable to data breaches and other security threats than encrypted ports. When you use this port, any data transmitted over the network can potentially be intercepted by unauthorized parties.

Moreover, Port 80 is designed to serve only HTTP requests. If you need to process HTTPS (HTTP Secure or HTTP over SSL) requests for better security, you have to switch to Port 443, which supports secured, encrypted connections.

Also, consider that many Internet Service Providers (ISPs) limit or even completely block traffic on Port 80. These limitations are often implemented to control spam, malware, and other forms of online abuse, which are commonly channeled through this port.

Finally, on Unix based systems (including Linux and MacOS), ports numbered under 1024 can only be opened by processes running with administrator privileges because these are well-known ports. This means that if you’re operating a service on Port 80, you might be required to launch your application with superuser rights, exposing your system to unnecessary risk.

If instead, we opt for a higher numbered port (e.g.: 8080), non-admin users will also be able to run the server without posing additional risks to the system.

See code below for how to instruct an application (Node.js in this case) to listen to port 8080 instead of port 80:

bash
const http = require(‘http’);
const hostname = ‘127.0.0.1’;
const port = 8080;

http.createServer((req, res) => {
res.statusCode = 200;
res.setHeader(‘Content-Type’, ‘text/plain’);
res.end(‘Hello World\n’);
}).listen(port, hostname, () => {
console.log(`Server running at http://${hostname}:${port}/`);
});

These considerations make it clear that while using Port 80 might sometimes seem like a straightforward option, it’s not always best suited for serving your digital applications or services.source

Understanding the Basics of Port 80: Why Not To Use Port 80

Port 80 is typically associated with web traffic. It is the default port for HTTP (HyperText Transfer Protocol), which is used to transfer hypertext requests and information between servers and browsers. Normally, when you enter a URL into your browser, it automatically tries connecting to the web server on port 80 unless otherwise specified.

However, there are certain compelling reasons for considering not to use port 80.

1. Security Concerns:

This port is considered insecure due to its lack of encryption capability. Any information transported through this port gets transferred in plain text format. Meaning, anyone who manages to capture these data packets can read and interpret the contained information leading potentially to compromisation of sensitive information.

  // Bad practice example
  http://www.yoursite.com

2. Prone to Attacks:

Being the default port for HTTP, it attracts much more traffic than other ports, making it a popular target among hackers and malicious intruders. Generic attacks like Distributed Denial-of-Service (DDoS) often target port 80 due to its universal reach.

Today, most websites opt for HTTPS, which uses port 443, as it transfers encrypted data that cannot be easily deciphered even if it gets intercepted.

  // Good practice example
  https://www.yoursite.com  

3. Requirement of Admin Privileges:

On Unix-based systems, ports below 1024, including port 80, require superuser privileges to bind to, rendering it inconvenient for running programs as normal users.

So, what’s the solution? The straightforward way to avoid these problems is to transition from HTTP to HTTPS. For transitioning, you’d need an SSL certificate installed on your server. This directs your site uses port 443 for sending data ensuring all data is encrypted before transmission.

Still, if you need to keep your application accessible via HTTP, consider using a reverse proxy like Nginx or Apache to serve your content over HTTPS while your app listens on a non-standard high-numbered or ephemeral port.

And never forget, always adhere to best security practices. Regularly patch and secure your servers, employ strong firewall rules, and apply rigorous monitoring of traffic; these could save you from potential future pitfalls.

For learning more about internet protocol suite, start by checking out the documentation from Internet Engineering Task Force(IETF).One of the foundational elements in web development and server maintenance is managing your network ports. Port 80, the default HTTP port, becomes almost integral to this process, but it also poses several security risks that can make your system vulnerable to attacks. Here’s why using Port 80 might not always be the best option:

Data Transmission in Plain Text

Internet browsers utilize HTTP (HyperText Transfer Protocol) by default on Port 80 to communicate with servers. However, HTTP transfers data in plain text format, which can become an easy target for malicious interceptors or hackers to exploit. It’s like sending your private data through a public channel without any safeguards. This raises concerns especially where sensitive user information is involved, such as login details, personal data, credit card information etc., causing potential threats to privacy and data integrity.

Vulnerability to Attacks

Another risk associated with using Port 80 is its susceptibility to different types of cyber-attacks:

• Man-In-The-Middle (MITM) attack: Because Port 80 uses HTTP, it exposes users to MITM attacks. In MITM, attackers position themselves between the communicating parties, eavesdropping or even altering the communication.
• Spoofing: Attackers can ‘spoof’ or fake their IP address, making it look like requests are originating from a trusted source – tricking victims into providing sensitive information.
• Distributed Denial of Service (DDoS) attack: Port 80 is a common target for DDoS attacks, where attackers can overload a network with large volumes of traffic, causing service disruption.

Potential Violations of Data Compliance Standards

If you’re handling customer data without implementing proper security measures like HTTPS on top of Port 443, instead of HTTP on Port 80, you could potentially violate data compliance standards such as General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) or Health Insurance Portability and Accountability Act (HIPAA). Non-compliance could lead to legal repercussions and hefty fines.

To mitigate these risks, it’s advisable to use secure HTTP—HTTPS protocol on Port 443, which encrypts data before transmitting over the internet. You can implement HTTPS by obtaining a Secure Socket Layer (SSL) or Transport Layer Security (TLS) certificate, which ensures the encryption of data transfer between servers and clients.

Here’s a basic example how you could redirect from HTTP to HTTPS in .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

While no measure guarantees total security, shunning Port 80 in favor of encrypted alternatives pushes us towards a safer web space. Therefore, awareness and understanding of these security implications is key for anyone venturing into the world of web development and server management.Developing secure online systems means ensuring data sent and received through your network is properly encrypted and protected from potential cyber attacks. You might have noticed port 80, a common HTTP port, isn’t recommended for transmitting sensitive data owing to its lack of security features. Using it can expose your system to unnecessary risks.

Reiterating on port 80’s limitations, it restricts your apps to unencrypted, clear text transmission. This leads to serious vulnerabilities such as:

– Data Interception: Because data is transmitted over this port in plain text, it could be intercepted by hackers.

– Lack of Authentication: Port 80 does not verify whether the server you are communicating with is the intended server or an imposter.

Recognizing these shortcomings, developers tend to switch to more secure alternatives, let’s delve deep into some well-regarded options:

Port 443 (HTTPS)

Serving as the default port for website traffic encrypted with SSL (Secure Sockets Layer) or its successor TLS (Transport Layer Security), Port 443 offers improved confidentiality, integrity, and authentication during data transferal. Simply put, HTTPS turns the data into an unreadable format, making it an ideal option for transmitting sensitive information like credit card numbers or login credentials. It also adds a layer of assurance that the server is the legitimate one by validating digital certificates.

Port 22 (SSH)

Secure Shell (SSH) Protocol is another secure standard widely used for executing commands remotely, managing networks, and transferring files securely over unsecured networks. Not only does it encrypt the entire session but it also requires user validation, adding an extra layer of safety against unauthorized access.

To hinge onto SSH, use

ssh username@hostname

, where the hostname is the name or IP address of the server you intend to connect to. For file transfers, use the Secure Copy Protocol (SCP) with the command

scp file.txt username@hostname:

Port 115 (SFTP)

Just as port 22 is secure for server connection, port 115 is typically used for secure file transfer. The Secure File Transfer Protocol (SFTP) facilitates data access and data transfer over a Secure Shell (SSH) data stream, thus ensuring high-end data transferral. It guarantees all connections are authenticated and data is encrypted before transmission.

However, ports 22 and 115 are typically dedicated to their respective purposes (SSH and SFTP). Should you be looking to serve web content securely to users’ browsers, port 443 (HTTPS) would be the most practical alternative to port 80.

In addition to switching ports, using firewalls and implementing strong password policies further strengthens your overall security. As modern day coding practices evolve, seeking more secure ways of data transmission becomes essential in any deployment infrastructure. Making a leap from port 80 to encrypted communication lines like HTTPS or SSH not only enhances your system security but also instills confidence in your end-users. Remember, it’s not just about keeping malicious actors from accessing your data. It’s about providing peace of mind for yourself and your users.

You may refer to this source for a wholesome read on the subject.Port 80 is the default network port for HTTP (HyperText Transfer Protocol) traffic. Many websites have traditionally used this port to serve non-secure, unencrypted content to users. Though it used to be highly popular in web communications, today most responsible websites have moved on from using port 80 due to the insecurities associated with unencrypted data transmission.

The fundamental problem with transmitting data over port 80 is that it’s notoriously unsecured. The data sent over this port isn’t encrypted, which means anyone who manages to intercept the transmission can read or modify its contents without needing a decryption key.

Implications of Unencrypted Data Transmission Through Port 80

Now let’s take a look at some of the key implications associated with sending data over an unencrypted channel such as port 80:

1. Data Breach: Without encryption, sensitive information like usernames, passwords, and credit card numbers are sent in plain text. Cybercriminals could exploit these vulnerabilities to gain unauthorized access to private accounts, leading to instances of fraud and identity theft.
2. Data Integrity: Besides reading your data, malicious actors can also alter the data being sent over an unencrypted connection.
3. Privacy Concerns: Since there is no encryption, all interactions between the users and the website can be tracked, leading to severe privacy concerns.
4. Decreased Trust: In modern browser implementations, sites served over HTTP (and thus potentially using port 80) are flagged as “not secure”. This can significantly lower user trust in your site, affecting reputation and traffic numbers.

Why Not To Use Port 80?

Given the serious security implications associated with unencrypted data transmission through port 80, it’s understandable why most modern websites opt not to use it:

• Browsers now prominently flag and warn users when visiting non-HTTPS websites, decreasing credibility and user trust in your website.
• Data breaches due to intercepted information can harm your company’s reputation and customer confidence. They may also result in heavy fines and legal action.
• The lack of encryption makes your system vulnerable to a variety of attacks including eavesdropping, man-in-the-middle, and data modification attacks.

Instead of port 80, it’s more secure (and has become best practice) to use port 443, utilizing SSL/TLS for securing data transmissions. SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols designed to provide a secure communication channel between two systems. Websites that utilize HTTPS encrypt their data with SSL/TLS, providing an enhanced layer of protection for user data.

Here’s how you can redirect HTTP port 80 traffic to HTTPS in .htaccess file:

#Force SSL
RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://yourdomain.com/$1 [R,L]

In summary, it’s critical for any organization to protect user data by avoiding unencrypted connections like port 80. For improved security and user confidence, always use HTTPS and secure ports like 443.The importance of port security cannot be overstated in the internet age. From an application, data, and network perspective, every open port presents a vulnerability that could be exploited by cybercriminals. Hence, it is necessary to understand why using port 80 to handle web traffic may not be ideal.

Port 80 is standard for HTTP (Hyper Text Transfer Protocol) traffic. If we delve deeper, the whole idea behind designing Port 80 was to facilitate unencrypted HTTP internet connections. This delivered superior functionality when the web was simpler, but times have changed, and so has the complexity of malware attacks(CloudFlare).

Unencrypted Communication:
Using Port 80 means that the information sent is not encrypted. Anybody could “eavesdrop” on the content being transferred. The content can include personal experience, sensitive data or confidential business information. For instance, consider an HTML form submitted over an insecure HTTP connection:

<form action="http://example.com/login" method="post">
<input type="text" name="username"/>
<input type="password" name="password"/>
</form>

In this scenario, the transmitted username and password details are delivered in plaintext. An intruder listening to the transmission will find it easy to extract sensitive information out of such communication.

Man-in-the-middle Attacks:
Port 80, being the default HTTP port, suffers from vulnerabilities due to man-in-the-middle (MITM) attacks (OWASP). In such an attack, the hacker intercepts the communication and impersonates both ends to gain access to sensitive information or inject malicious data. Using HTTPS via port 443 instead, which is secured via SSL/TLS encryption, would minimize these risks, as all data exchanged between users and websites becomes encrypted, making MITM attacks near impossible.

Insecure Cookies:
Cookies transmitted over HTTP or port 80 are also at risk. Here’s an example of a typical HTTP Set-Cookie header:

Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2021 07:28:00 GMT;

This cookie is not secure and is susceptible to capture over an unprotected network. However, an HTTPS-secured cookie looks like this:

Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2021 07:28:00 GMT; Secure;

The presence of the “Secure” attribute makes this cookie safe against potential interception.

Vulnerability Scanning Tools:
Most vulnerability scanning tools prioritize port 80, which increases the overall possibility of an attack if port 80 is open. Tools like Nmap or Nessus use default settings that scan popular ports, including port 80.

While migrating from port 80 (HTTP) to port 443 (HTTPS) might seem like an arduous process that requires effort, integration, and maintenance, but the expansive benefits of securing user data and enhancing your cyber resilience make this pathway a cyber hygiene essential. Overall, moving away from port 80 gives another layer of protection against potential cyber threats.As a professional coder, security is one of my top concerns. I’ve become intimately familiar with many different toolsets and methods designed to safeguard digital assets; among them, firewalls have consistently remained the frontline warrior. Firewalls play an integral role in shielding system resources from potential threats by blocking unauthorized access while permitting authorized communications to pass. One particular aspect where firewalls shine is their role in managing and protecting insecure ports – like the often-debated port 80.

Taking into account SEO, it’s important to understand that port 80 is the default web server communication port which allows http (Hyper Text Transfer Protocol) traffic. The significant issue around using port 80 is its reputation as a target for numerous cyberattacks due to it being unencrypted and easy to exploit.

How does a firewall come into the picture here? Broadly speaking:

– A firewall filters traffic based on rules we set; hence we can block or allow traffic on any port, including port 80.

– It also helps in monitoring what type of data is flowing through our network. If it detects suspicious behavior, it can prevent it before damage occurs.

– Upon detecting an attempted breach towards a specific port, firewalls can respond by redirecting incoming requests to more secure ports like 443 – used for HTTPS (HTTP Secure).

Examining this from a coding perspective, let’s take Linux-based systems, for example. Here’s how you implement firewall rules via the “iptables” command to block port 80:

sudo iptables -A INPUT -p tcp --dport 80 -j DROP

In the code snippet above, “-A INPUT” denotes adding a rule to inbound traffic, “-p tcp” mentions the protocol, “–dport 80” points out port 80, and the final argument “-j DROP” signifies that all matching packets will be dropped i.e., no response is sent, hence creating a ‘black hole.’

To allow only certain IP addresses access to port 80, you might use:

sudo iptables -A INPUT -p tcp -s {IP_ADDRESS} --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j DROP

The first line permits traffic exclusively from ‘{IP_ADDRESS}’ on TCP port 80. The second line then blocks all other traffic aiming towards port 80.

For reference purposes, the table depicts the port numbers for HTTP and HTTPS.

So why not use port 80? Main reasons include:

– Lack of encryption: As previously mentioned, port 80 does not encrypt data, leaving information like login credentials and sensitive user data susceptible to being intercepted by malicious entities.

– Susceptibility to attacks: Its widespread popularity makes targeting port 80 very enticing for hackers. They know many servers have open port 80 leading to common attacks such as DoS (Denial of Service) or DDoS (Distributed Denial of Service), turning the system’s accessibility against itself.

Therefore, in the age of increasing digital dependency and rising cybersecurity threats, it becomes prudent to weigh out the cons of using port 80, adopting safer practices instead. This is where our trusty gatekeeper – the firewall, makes an entrance, either rejecting or accepting data based on our preconfigured rules and regulations.

For further understanding and application, I highly recommend exploring online resources like RFC 2616, which dictates HTTP protocols over TCP/IP and various documentation on firewalls spanning many platforms.

See also

NetworkingProtocol

·August 18, 2023·25 min read

Is Udp Connectionless

Source code examples:

Sure, primarily when managing your server or maintaining a system there are some critical aspects that should never be overlooked. Leaving TCP/IP connections open at port 80 is one of these as it carries potential repercussions that could affect the overall security and performance of your system.

Firstly, let’s touch on the concept of TCP/IP and port 80. Transmission Control Protocol/Internet Protocol (TCP/IP) is an end-to-end communication protocol that serves as the foundation for the internet. It is through these protocols that systems are able to communicate over the network.

Port 80, on the other hand, is the default port designated for serving HTTP (HyperText Transfer Protocol) requests. It is worth noting that port 80 is non-encrypted, meaning all data sent through this port is sent in plain text format. This poses many security vulnerabilities such as:

– Unencrypted Data: Unencrypted data makes it very easy for cybercriminals to perform man-in-the-middle attacks where they can intercept and read data being transferred over lucid networks. They can gather vital information like passwords, account details, and confidential data which can then be used for malicious purposes.

// Bad practice example - making unsecured HTTP request
fetch('http://example.com/data')
    .then(response => response.json())
    .then(data => console.log(data));

Secondly, leaving port 80 open comes with performance repercussions. When a large number of connections are kept open, this can saturate the server and slow down its operation. More connections mean more allocated resources to maintaining those connections which can potentially lead to performance degradation or even server crashes if limits are exceeded.

– Performance Degradation: High resource allocation to keep connections open can result in reduced server performance, causing slower response times, fewer simultaneous user connections, and an overall poorer user experience.

Now addressing the question, “Why not to use Port 80?”, using port 80 equates to foregoing HTTPS (Secure HTTP), which utilizes encryption to secure data during transmission.

Here’s why it’s essential to opt for secured ports over port 80:

– Better Security: Encrypted data deters unauthorized access and mitigates the risk of a data breach. Using HTTPS provides website authentication, ensuring users that their data won’t be intercepted.

// Best practice example - making secured HTTPS request
fetch('https://example.com/data')
    .then(response => response.json())
    .then(data => console.log(data));

– Improved Trust: Websites using HTTPS often display a padlock icon in the address bar, indicating to users that their connection is secured, promoting trust.

– SEO Advantage: Search engines favor websites using HTTPS, contributing positively to SEO efforts and improving website visibility. Check out [Google’s SEO starter guide] for more insights.

Leaving TCP/IP connections open at port 80 not only imposes considerable security risks but also affects the system’s overall performance. Prioritizing encrypted connections and securing your server is the best strategy to ensure reliable and protected operations.Indeed, shifting to HTTPS and leaving behind port 80 is a significant move some might consider. Provocatively speaking, you’re modifying the skeleton of your client-service architecture, hence such transformations require meticulous analysis.

Security Preeminence
Perhaps one of the most paramount reasons for abandoning the use of port 80 is about security. Port 80 is dedicated to HTTP traffic which means that any data transferred using this port lacks encryption. HTTPS services running on port 443, on the other hand, provide data transactions with end-to-end encryption. This shields your confidential information from cyber threats. Here’s how HTTP request / response looks like:

GET / HTTP/1.1
Host: www.example.com

And here is how HTTPS version looks like (with encrypted Body):

GET / HTTP/1.1
Host: www.example.com
... Encrypted Data ...

Improved SEO Ranking
Search engines have started leaning towards websites that ensure safer browsing experiences for their users. Transitioning to HTTPS aids in pushing forward your website in search result rankings—an essential aspect in the prevailing competitive digital landscape.

Foster User Trust
Users are more likely to trust and feel safe browsing a site that uses HTTPS. A secure connection attribute not only protects user information but also ensures they feel confident in sharing sensitive details.

Mandatory for HTTP/2
HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web. It offers improved speed, but it requires TLS (Transport Layer Security) — a cryptographic protocol designed to provide communications security over a computer network. If your application wants to leverage HTTP/2, port 80 should be ditched for port 443, allowing use of HTTPS.

Encountering The Downsides
Though seemingly insignificant, there exist few ramifications associating transitioning to HTTPS. One apparent consequence includes overheads of setting up SSL. This implies time and energy invested by your developers for incorporating, maintaining, and updating SSL certificates. A code snippet for establishing an SSL context can be elevated as shown:

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
localhost_pem = pathlib.Path(__file__).with_name("localhost.pem")
ssl_context.load_cert_chain(localhost_pem)

Another potential downside may revolve around legacy systems or old browsing software that may fail to support HTTPS connections.

Ultimately, replacing port 80 with port 443 for HTTPS uncovers a wealth of perks including enhanced security, better SEO ranking, boosted user confidence and compatibility with upgraded protocols like HTTP/2 at the expense of handling the slightly tedious task of managing SSL certificates and addressing backward compatibility. It’s a substantial shift that many modern-day web applications should contemplate for bolstering their overall service integrity.

Find more about Http vs Https on Globalsign Blog.

Port scanning is a prevalent method used by hackers to identify open ports in a system, which are potential entry points to access and exploit the system. One such port that can raise substantial security concerns is port 80, commonly known as the HTTP “hotspot”. Considering the wide usage of the HTTP protocol, it’s safe to say port 80 acts like a beacon for potential intruders looking to make their way into your system or network.

Dangers Affiliated with Port Scanning

• Infiltration: By exposing an open port such as port 80, attackers could gain unauthorized access into your system. Virtually any software has inherent vulnerabilities, including web servers that run via port 80. Hackers can exploit these weaknesses to seize control of your server.
• Denial-of-Service attacks: Port 80 is particularly vulnerable to Distributed Denial-of-Service (DDoS) attacks. In this case, attackers bombard your system with enough traffic to overwhelm resources and bandwidth, making your site unavailable to legitimate users.
• Data theft: Data transmitted over unencrypted HTTP connections through port 80 can be intercepted and stolen by sniffing tools that detect and capture data packets.

If one must use port 80, it should be limited to redirecting incoming requests to HTTPS via port 443, thus securing the transmission. Below is an example of how to implement such a redirect in .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This technique redirects all HTTP traffic to HTTPS, providing end-to-end encryption.

Best Practices for Secure Communication

To limit the attack surface exposed to the internet, it is recommended not to use port 80 in web application deployment. Instead, secure protocols like HTTPS should be used. HTTPS comes with two significant advantages:

• Encryption: Since HTTPS provides end-to-end encryption, it makes data unreadable to anyone except for the client and the server intended to read it.
• Integrity: HTTPS ensures the data is not tampered with during transmission. It means files cannot be corrupted or modified during transfer without it being detected.

Furthermore, it’s essential to conduct regular port scans on your systems using tools like NMAP to understand which services and ports are visible to the outside world. By doing so, you can ensure only necessary ports are left open and promptly close unnecessary ones.

Besides adopting secure communication protocols, another crucial step is timely patch management. Web servers and their underlying software components should be regularly updated to fix any vulnerabilities that may have been discovered since the last update.

Inspecting the reasons why not to use Port 80, we find that it goes beyond just convention and delves into security aspects of web communications. One fundamental reason is the inherent lack of security encryption in data transfer over port 80.

Port 80 is inherently an insecure port as it does not use any encryption during data transfer. The Hypertext Transfer Protocol (HTTP) used over Port 80 does not have built-in security which means,

http://www.example-site.com

will send data unencrypted over the network over Port 80. If a client communicates sensitive data like passwords or credit card information, this can be intercepted by malicious attackers during transit. This stands in stark contrast with (Hyper Text Transfer Protocol Secure) HTTPS, which operates on Port 443 and provides end-to-end encryption initiated by SSL (Secure Sockets Layer) or its successor TLS (Transport Layer Security).

One major disadvantage of Port 80 lies in its historical usage. Being the default port for unencrypted web traffic for many years, bad actors on the Internet often target Port 80 for attacks such as Distributed Denial of Service (DDoS) attacks, making it somewhat hazardous for serving reliable content.

Furthermore, with the advent of privacy-focused regulations such as the General Data Protection Regulation (GDPR), organizations are required to take adequate measures to protect user data. This entails migrating from unsecure HTTP connections over Port 80 in favor of secure HTTPS.

Switching to a more secure option has become easier than ever as tools and services, like [Let’s Encrypt](https://letsencrypt.org/), provide free SSL certificates, thus enhancing trust and security for both website owners and their visitors.

Diving into the aspect of doing server-side redirection – Users often type website URLs without specifying the protocol or port. In most web servers (like Apache, Nginx), there exists an ability to enforce HTTPS redirect, so even if a user types in an HTTP address (which defaults to Port 80), it will automatically redirect to its HTTPS variant (over Port 443). Case in point:

<enableSslRedirect>true</enableSslRedirect>

Recommendation-wise, due to the combination of improved security, enhanced reliability, and regulatory compliance, it is deemed prudent to avoid utilizing Port 80 for contemporary web communication services. Using HTTPS over Port 443 ensures data integrity, confidentiality, and instills greater trust among your audience, fulfilling the web community’s shared responsibility toward a safer and more private internet.