Plain HTTP is not served at all
What this check looks for
Nothing answers on the insecure port. That is a safe configuration — there is no unencrypted request to intercept — with one practical caveat.
Why it matters
Nothing is wrong here. It is recorded because it explains why no HTTP-to-HTTPS redirect is reported, and because two things quietly depend on port 80: certificate renewal over the ACME HTTP-01 challenge, and visitors who type your address without a scheme, who will see a connection error rather than your site.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- HTTP
- Module
- Http reachability
- Fix owned by
- user
- In the ruleset since
- 2026.09
Technical detail
http://‹host›/ did not answer: ‹detail›. If certificates are renewed over the HTTP-01 challenge, port 80 has to be reachable for /.well-known/acme-challenge/ — use the DNS-01 or TLS-ALPN-01 challenge instead if it is deliberately closed. Browsers do not fall back from https to http, so a visitor typing a bare hostname reaches a dead port unless the name is in the HSTS preload list.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.