Web Server

What is a web server?

A web server is software, often embedded in a device, that serves web pages or web applications over HTTP or HTTPS to a browser or another client. In OT environments many devices contain such a web server, so technicians can check status, change settings and run diagnostics without dedicated software. That convenience comes at a price: an embedded web server is also one of the most frequently found and exploited attack surfaces in industrial networks.

Web servers are built into many industrial components, such as PLCs, HMIs, drives, switches, smart sensors and firewalls.

🧠 How does a web server work?

1. Request - a client, such as a laptop or Engineering Station, sends an HTTP request to the device’s IP address, for example https://192.168.0.10. By default HTTP uses port 80 and HTTPS port 443.
2. Processing - the web server should first check who the user is. It then reads the requested data from the device or carries out the requested change.
3. Response - the server returns an HTML page or, on modern devices, JSON data through a REST interface.
4. Interaction - through the browser the user can:
   • read status information and diagnostic buffers;
   • change configuration parameters such as the IP address and time synchronisation;
   • view and export log files;
   • carry out Firmware updates or back up settings.

The meaning of HTTP methods and status codes has been defined in RFC 9110 since 2022. HTTPS is the same HTTP communication, carried over an encrypted TLS connection.

🔧 What types of web server are found in OT?

An industrial web server is rarely an Apache or IIS installation. It is usually a small server embedded in the firmware, and that determines how you manage and secure it.

Older devices sometimes still rely on Java applets or legacy browser plug-ins. Modern browsers no longer support them, so technicians keep outdated browsers or Java versions on their laptops, which is a risk in itself.

🔄 What is the difference between a web server and engineering software?

The web server is mainly a maintenance tool. Engineering software is not automatically more secure: protocols such as S7 Comm also had weak or no authentication for a long time. The real difference lies in how many functions you expose.

🏭 Where do you use a web server in industrial networks?

• PLC diagnostics - the web interface of a PLC or HMI shows the diagnostic buffer, cycle time and module status, which is useful during a fault when no engineering laptop is at hand.
• Drives - configuring a variable frequency drive or backing up its parameters through the built-in web page.
• Network management - configuring an Industrial Ethernet switch, for example from Hirschmann, Moxa or Cisco.
• Security appliances - Firewall management through a web interface on OT firewalls and routers.
• Maintenance - firmware updates or backups of settings through web-based tools.
• Remote operation - web HMIs and dashboards on tablets on the shop floor.

A web server gives quick access to device settings, often without extra software. That is exactly why attackers find it attractive too.

🔐 Why is a web server a risk in OT?

Embedded web servers combine three weaknesses: they run on firmware that is rarely updated, they often ship with default accounts, and they provide write access to the process. Security therefore has to be designed in, not added afterwards.

• Firmware vulnerabilities - a well-known example is the Phoenix Contact ILC 1xx series. According to a CISA advisory from November 2016, attackers could bypass the web server’s authentication, open HMI pages and read and write PLC variables. Passwords for HMI pages could also be stored and transmitted in cleartext. Such CVEs still appear regularly for many brands.
• Unencrypted connections - over HTTP, passwords and parameters cross the network in readable form.
• Default passwords - factory accounts are often left unchanged after commissioning.
• Self-signed certificates - technicians learn to click away browser warnings, so a man-in-the-middle no longer stands out.
• Internet exposure - search engines such as Shodan find web interfaces of PLCs and HMIs connected directly to the internet; see Internet-Exposed OT.

🛡️ How do you secure a web server on an OT device?

1. Take inventory - record in your asset inventory which devices have a web server and whether it is enabled. Vulnerability scanning or passive network monitoring helps here.
2. Disable what you do not use - IEC 62443-3-3 (SR 7.7) and IEC 62443-4-2 (CR 7.7) require least functionality: only the functions, ports and services that are needed. On a SIMATIC S7-1200 or S7-1500 you have to activate the web server explicitly in TIA Portal; leave it off if nobody needs it.
3. Enforce HTTPS - disable HTTP and select HTTPS-only access in the device settings. The TLS guidelines of the Dutch NCSC rate TLS 1.3 as good, TLS 1.2 as sufficient and TLS 1.0 and 1.1 as to be phased out. Since RFC 8996 (March 2021), TLS 1.0 and 1.1 have also been formally deprecated.
4. Manage certificates - replace self-signed certificates with certificates from your own CA through certificate management.
5. Control accounts - change default passwords, create personal accounts with read-only or write rights and use MFA where the device supports it.
6. Restrict access - make web interfaces reachable only from a management VLAN or through a jump server, with a Firewall or ACL in between. This fits network segmentation along the lines of the Purdue Model.
7. Monitor and patch - send login attempts to a SIEM or Syslog server and include web server CVEs in your patch management.

🇪🇺 Which rules apply to web servers in industrial products?

For a Dutch drinking water company or chemical plant this means in practice: web interfaces of PLCs and switches do not belong on the internet, are only used through secured remote access and are listed in the risk register.

❓ Frequently asked questions

Should I disable the web server on my PLC?

Disable the web server on a PLC if nobody uses it for diagnostics or maintenance. Every active web server is an extra entry point for attackers and requires patching, account management and monitoring. If you do need it, restrict it to HTTPS and a management network.

Is HTTPS on an industrial device enough security?

HTTPS on an industrial device only encrypts the connection between the browser and the web server. It does not protect against weak passwords, firmware vulnerabilities or access from the wrong network. Combine HTTPS with strong authentication, segmentation and patch management.

Why does my browser show a certificate warning for a PLC web server?

Many PLC web servers use a self-signed certificate that the browser does not trust. The connection is encrypted, but you cannot verify that you are really talking to the right device. A certificate issued by your own CA resolves the warning structurally.

How do I find web servers in my OT network?

You find web servers in an OT network through an asset inventory, passive network monitoring or a careful scan of ports 80 and 443. Active scanning can disrupt older devices, so only do it in consultation with whoever is responsible for the process. Also check whether devices are visible from the internet.

What is the difference between a web server and a web HMI?

A web server is the technical service that delivers pages over HTTP or HTTPS. A web HMI is an operator application that runs on such a web server and shows process graphics in the browser. A web HMI often grants write access to the process and therefore needs extra protection.

📌 In summary

A web server gives quick browser access to the configuration and status of industrial devices, but it is also one of the most frequently abused entry points into OT networks. Disable unused web servers, enforce HTTPS with modern TLS, replace default passwords and keep management interfaces behind segmentation and a jump server, in line with IEC 62443, the Cyber Resilience Act and the Dutch Cybersecurity Act.