Usually nothing; any webserver has port 80 open at all times, if only to transmit https redirects. It would be easy to attack the server if it was running a vulnerable version of a web server or scripts with security weaknesses (for example, a wordpress installation with outdated plugins).