Why windows still use port 80 for windows update

Question

Hi,

Everyone already knows that Port 80 is vulnerable. But still, I can see my system is using port 80 for windows updates.

Is there any way to stop using port 80 for windows updates?,If I block port 80 for all the systems in my org for windows updates will it impact the win update process?

Why is MICROSFT still using port 80?

Answer 1

Hi @Reyan

Unfortunately , the http is required to download Windows update from WSUS. the https is used only for metadata. By default WSUS use the port 8530 for HTTP ad 8531 for HTTPS.

Below a confirmation from Microsoft article: Configure the WSUS server's IIS web server to use SSL for some connections

Please don't forget to mark helpful answer as accepted

Answer 2

Hello

Thank you for your question and reaching out. I can understand you are having query\issues related to Windows update ports uses 80.

WSUS uses both port 80 for HTTP and 443 for HTTPS. Main reasons being:

A) HTTP is easily cached by any (regular, forward) proxy.

B) The updates are always digitally signed and thus tamper-resistant at the application level.

C) You don't need a certificate management

Reference :

https://learn.microsoft.com/en-us/answers/questions/726098/is-windows-update-on-clients-is-end-to-end-encrypt

--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Double post