{
  "port": 80,
  "protocol": "tcp",
  "service": "HTTP",
  "oneLiner": "Plain HTTP — the unencrypted web port, now mostly a redirector to 443 and an ACME challenge endpoint.",
  "whatItIs": "A web server (nginx, Apache httpd, Caddy, or an application framework) accepts HTTP/1.1 requests here in cleartext, with the target host chosen by the Host header. In current deployments its main jobs are issuing a 301 to https:// and serving Let's Encrypt HTTP-01 challenges under /.well-known/acme-challenge/. It is also the default listener for dev servers, containers, and load balancer backends behind a TLS terminator. Anything on 80 is readable and modifiable by any network in the path.",
  "exposure": {
    "verdict": "fine",
    "note": "Fine to expose when it only redirects to HTTPS and serves ACME challenges; never serve credentials, cookies, or private content over it."
  },
  "checkCommand": "curl -sv -o /dev/null http://example.com/",
  "links": [
    {
      "title": "RFC 9110 — HTTP Semantics",
      "url": "https://www.rfc-editor.org/rfc/rfc9110.html",
      "kind": "spec"
    },
    {
      "title": "RFC 9112 — HTTP/1.1",
      "url": "https://www.rfc-editor.org/rfc/rfc9112.html",
      "kind": "spec"
    },
    {
      "title": "nginx documentation",
      "url": "https://nginx.org/en/docs/",
      "kind": "official-docs"
    },
    {
      "title": "Apache HTTP Server 2.4 documentation",
      "url": "https://httpd.apache.org/docs/current/",
      "kind": "official-docs"
    }
  ]
}