port 80
Port 80 is the well-known HTTP port defined by RFC 9110, and it stays open on most servers even after HTTPS became standard, usually just to redirect.
The catalog marks security as insecure because the protocol itself does not encrypt, regardless of how the server is configured behind it.
The 301 status signals a permanent redirect, so browsers and crawlers tend to remember it and stop trying the port 80 version.
Blocking port 80 during automatic certificate renewal silently breaks the issuance of the next TLS certificate.
Deliberate decision: unauthorized port scanning is an abuse vector and has legal implications in several countries. We prefer a clear, safe reference.
Only if the site does not rely on ACME's HTTP-01 challenge for certificate issuance, and even then users who type `http://` without TLS get no response instead of a redirect to HTTPS. Keeping port 80 open just for the 301 is usually the safer option.
80 is the well-known port the browser assumes by default in every `http://` URL. 8080 sits in the registered range (1024 to 49151) and is a common alternative when the process lacks the privilege to open ports below 1024, or to expose a development service without conflicting with the main server.
Practically never. Outside the ACME challenge and isolated internal environments with no external exposure, serving real content without TLS on port 80 exposes cookies and data to any intermediary on the network.
Cleartext HTTP. In production always use HTTPS (443).
Everything runs locally in your browser from an embedded catalog. This tool does not connect to IPs or ports, it is not a scanner.