Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If IIS has a vulnerability and a administrator shuts down port 80 so IIS cannot listen on it. Will that same vulnerability be present on port 443(https)? Thank you for taking the time to look consider this.

share|improve this question

migrated from Jul 19 '11 at 15:53

This question came from our site for professional and enthusiast programmers.

I agree with Paul, but quick answer here. It depends, if there's applications that can be exploited that listen on the port. – Jesus Ramos Jul 19 '11 at 15:17
The correct answer is: It depends on the vulnerability – Adam Batkin Jul 19 '11 at 15:20
I know this is related to your other question. Is there a business need for you to have port 80 open? Or do you just not want to have to use port 443? – Nixphoe Jul 19 '11 at 16:08
@Nixphoe, Yes there is a business need. We need to host a site using port 80 the firewall isn't letting the requests through because of its current ruleset. – george9170 Jul 19 '11 at 17:23
up vote 3 down vote accepted

It depends on the exact vulnerability, but in general yes. If the vulnerability is with an application on the IIS server, then it is extremely likely to be still vulnerable.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.