What Is Port 8080? How It Differs from Ports 80 and 443
-
Port 8080 is the most common alternative to port 80 for web traffic. Here's why it exists, where you'll run into it, and what it means for SSL certificates and domain validation.
- Automatic renewals
- Less manual work
-
-
*
Ports 80, 443, and 8080 at a Glance
Port 80 Port 443 Port 8080 Protocol HTTP HTTPS (HTTP over TLS) HTTP by default Encryption No Yes No, unless configured Port in the address Not needed Not needed Required, e.g. :8080 Typical use Public websites, redirects to HTTPS Public websites Development, internal services, backends Port 8080 is officially registered with IANA, the organization that assigns port numbers, as HTTP Alternate. For more on the standard HTTPS port, see What Is Port 443? The HTTPS Port Explained .
-
*
Why Port 8080 Exists
- Avoiding conflicts. Only one service can listen on a port at a time. If a web server already uses port 80, a second web service needs a different port, and 8080 became the usual choice.
- No administrator rights needed. On Linux and macOS, ports below 1024, including 80 and 443, can only be opened by programs with root privileges. Port 8080 can be used by any program. Windows doesn't have this restriction, but 8080 is still used there out of habit.
-
*
Where You'll See Port 8080
- Development servers. Tools such as Apache Tomcat and Spring Boot start on port 8080 by default, so developers can test an application without changing system settings.
- Behind a reverse proxy. In production, a web server such as NGINX receives visitors on port 443 and forwards their requests to the application running on port 8080. Visitors never see port 8080.
- Containers. Many Docker images run their application on port 8080 inside the container. The host then maps it to a standard port, for example with -p 80:8080.
- Internal tools. Admin panels, monitoring dashboards, and internal APIs often run on 8080 because they're meant only for the internal network.
-
*
Port 8080 and SSL
Port 8080 carries plain, unencrypted HTTP unless you set it up otherwise. There are two ways to protect it:
- Use a reverse proxy (recommended). Install the SSL certificate on a web server or load balancer that listens on port 443, and let it forward traffic to port 8080 internally. The application doesn't need to handle certificates at all.
- Enable HTTPS on the application itself. If the service must be reached directly, configure it for HTTPS. By convention, HTTPS on an alternative port uses 8443 rather than 8080.
Important: Certificate authorities don't validate domains through port 8080. File-based validation uses port 80 or 443, and the ACME HTTP-01 challenge uses port 80 only. If your site runs only on port 8080, either open port 80 for validation or choose DNS validation instead.
-
*
Keeping Port 8080 Secure
Services on port 8080 are often left with default settings because they're considered internal, which makes them an easy target once someone gets into the network. Don't expose port 8080 to the internet unless you have to, and allow access only from trusted IP addresses. For example, with UFW on Linux:
sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp
This allows connections to port 8080 only from the local network 192.168.1.0/24. Replace it with your own trusted network range.
-
