Port 8080: alternative HTTP port explained

What port 8080 is

TCP port 8080 is the most common alternative to port 80 for plain HTTP. It became popular because ports below 1024 need root privileges on Unix, so services running as an ordinary user picked 8080 instead. Traffic on it is unencrypted HTTP unless the software is configured for TLS, which usually happens on port 8443 instead.

Software that uses 8080 by default includes:

Apache Tomcat, its HTTP connector.
Jenkins.
Spring Boot, whose embedded server listens on 8080.
Many container images, which listen on 8080 so they can run as a non-root user.
Proxies and admin panels on routers and appliances.

Should it be open to the internet?

Usually not. A public site should be on 80 and 443, with 80 redirecting to HTTPS. If an app listens on 8080, put a reverse proxy in front and keep 8080 private:

server {
    listen 443 ssl;
    server_name app.example.com;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

An open 8080 is often an accident: an app server or admin panel reachable without TLS, sometimes serving the same site as 443 without the security headers your proxy adds. Admin interfaces like Jenkins or the Tomcat manager are frequent targets, so they should never be public without authentication.

Firewall rules

sudo ufw allow from 203.0.113.0/24 to any port 8080 proto tcp
sudo ufw deny 8080/tcp

ufw applies the first matching rule, so the allow must come before the deny. Leave out the allow line to block the port for everyone. With iptables:

sudo iptables -A INPUT -p tcp --dport 8080 -s 203.0.113.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP

With Docker, publish on loopback (-p 127.0.0.1:8080:8080). Ports published on all interfaces bypass ufw on most Linux hosts.

How to check what is listening

sudo ss -tlnp | grep ':8080'
sudo lsof -i :8080
curl -I http://127.0.0.1:8080/

0.0.0.0:8080 or *:8080 means every interface; 127.0.0.1:8080 means local only.

"Port 8080 already in use"

Because so many tools default to 8080, collisions are common: a Tomcat service, a Jenkins install and a container all wanting the same port. Find the owner:

sudo lsof -i :8080

On Windows:

netstat -ano | findstr :8080
taskkill /PID 12345 /F

Then stop the other process or move one service. In Spring Boot, set server.port=8081; in Tomcat, change the port attribute of the HTTP Connector in conf/server.xml; for Jenkins, use --httpPort=8081 or the JENKINS_PORT setting of your package; in Docker, map -p 8081:8080.

8080 behind a CDN

Some CDNs proxy a fixed set of alternative ports. Cloudflare, for example, proxies HTTP on 8080 (among others) so an origin on 8080 can be reached through it. If you rely on this, remember the origin still needs a firewall so visitors can't bypass the CDN.

Port 80: standard HTTP.
Port 443: HTTPS.
Port 8443: the usual alternative HTTPS port.
Port 3000: Node.js and Rails dev servers.

Check whether 8080 is open on your server with the Port Scanner, and see what it answers with the HTTP Status Checker.