Our software runs on 443 (https) on IIS and our network administrator insist on closing port 80 on the firewall. Port 80 would be used to redirect to 443.

The problem is that the users now need to type "https://" specifically in the browser to access the site (which they don't). Without port 80 it isn't possible to redirect to 443.

So, does closing port 80 make the server more secure?


There is a argument that is occasionally made that disabling the port 80 protects you from errors created by you web developer. Who might unitentionally have a form with data that needs to be secure aimed at the http site instead of the https site. If port 80 is closed then the tcp handshake will fail and no data will be sent insecurely. If port 80 isn't closed and the user's browser is badly configued then secure data might be sent insecurely.

There is an attack called SSL stripping. this attack tool can watch for redirects from http to https and then adjust the redirect sent over http to point at the proxy in a way that will keep the traffic unencrtped rrsulting in a MITM.

See also:


No, having port 80 open is not insecure.

Having sensitive data transmitted on port 80 however, is very insecure. Which is probably the line of thought of your network administrator.

Forcing users to manually type https in the server address is something that most of the web has moved away from in the later years.. There is no need to treat your users like IT experts when it's easy to redirect.

We're using two different virtual sites on our IIS. One that listens on port 80 with a blank virtual directory, where the only thing set is the IIS "HTTP Redirect" that points to our other virtual host, which runs -only- on https like your admin has set up. This works excellent.

  • Redirecting can be dangerous, there are tools that exist that can intercept and redirect the redirect to a proxy. this is partly the reason for HTTP Strict Transport Security en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
    – Zoredache
    Sep 19 '12 at 7:03
  • @Zoredache You beat me to it. Blatant redirection can be dangerous. My recommendation is to keep 80 open but point it at a separate web-server instance. This only contains a single information page with a LINK (not a re-direct) to the HTTPS site. The page also gives some info on why and instructs the users to update their bookmarks.
    – Tonny
    Sep 19 '12 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.