@@ -123,14 +123,21 @@ public static int GetTimeout(int port, string scheme, int timeout)
     }
 
     /// <summary>
-    ///     Gets the schemes to try for a port: http for 80 / 8080, https and then http for any other port (a TLS
-    ///     handshake with a plain http server fails right away).
+    ///     Gets the schemes to try for a port: https for 443 / 8443 (if the TLS handshake fails, e.g. a device that
+    ///     only supports TLS 1.0, http would only return the error page of the server for plain http on an https port),
+    ///     http for 80 / 8080, https and then http for any other port (a TLS handshake with a plain http server fails
+    ///     right away).
     /// </summary>
     /// <param name="port">Port number.</param>
     /// <returns>Schemes in the order to try them.</returns>
     public static string[] GetSchemes(int port)
     {
-        return port is 80 or 8080 ? ["http"] : ["https", "http"];
+        return port switch
+        {
+            443 or 8443 => ["https"],
+            80 or 8080 => ["http"],
+            _ => ["https", "http"]
+        };
     }
 
     /// <summary>
 
@@ -69,7 +69,8 @@ public void GetTimeout(int port, string scheme, int timeout, int expected)
     [Theory]
     [InlineData(80, new[] { "http" })]
     [InlineData(8080, new[] { "http" })]
-    [InlineData(443, new[] { "https", "http" })]
+    [InlineData(443, new[] { "https" })]
+    [InlineData(8443, new[] { "https" })]
     [InlineData(9000, new[] { "https", "http" })]
     public void GetSchemes(int port, string[] expected)
     {
 
@@ -420,7 +420,7 @@ Timeout in milliseconds after which an mDNS request is considered lost.
 
 ### Read web pages
 
-Read the web page (`GET /`) of every reachable host with an open port of the [Ports](#ports-1) below: status code, title, the `Server` and `X-Powered-By` headers, the realm of a login prompt (`WWW-Authenticate` header of a `401` response, e.g. `RT-AC68U` - routers, cameras and printers often name their model there) the target of a redirect to another host (e.g. `https://unifi.local:8443/`) and, for https, the TLS certificate: subject, issuer (`Self-signed` for a self-signed certificate) and the end of the validity (`(expired)` if it is expired). The title is shown in the **Web** column (the URL in the tooltip), all values in the **Web** section of the row details. The ports are tried in the order of the list, the first one that answers is used: http on `80` and `8080`, https and then http on any other port. On ports other than `443` / `8443`, the https attempt waits at most 1 second (also with a higher timeout), so a plain http device that doesn't answer the TLS handshake doesn't cost the whole timeout before http is tried. Redirects on the same host (e.g. http to https, `/` to `/login.html`) are followed. If the page has no title, the column shows the realm, the `Server` header (e.g. `nginx`) or the redirect target. The values are in the search and the export (`WebStatusCode`, `WebServer`, `WebPoweredBy`, `WebRealm`, `WebRedirectURL`, `WebCertificateSubject`, `WebCertificateIssuer`, `WebCertificateNotAfter`, `WebCertificateSelfSigned`). **Web Console** in the context menu opens the port (and scheme) that answered.
+Read the web page (`GET /`) of every reachable host with an open port of the [Ports](#ports-1) below: status code, title, the `Server` and `X-Powered-By` headers, the realm of a login prompt (`WWW-Authenticate` header of a `401` response, e.g. `RT-AC68U` - routers, cameras and printers often name their model there) the target of a redirect to another host (e.g. `https://unifi.local:8443/`) and, for https, the TLS certificate: subject, issuer (`Self-signed` for a self-signed certificate) and the end of the validity (`(expired)` if it is expired). The title is shown in the **Web** column (the URL in the tooltip), all values in the **Web** section of the row details. The ports are tried in the order of the list, the first one that answers is used: https on `443` and `8443`, http on `80` and `8080`, https and then http on any other port. On ports other than `443` / `8443`, the https attempt waits at most 1 second (also with a higher timeout), so a plain http device that doesn't answer the TLS handshake doesn't cost the whole timeout before http is tried. Redirects on the same host (e.g. http to https, `/` to `/login.html`) are followed. If the page has no title, the column shows the realm, the `Server` header (e.g. `nginx`) or the redirect target. The values are in the search and the export (`WebStatusCode`, `WebServer`, `WebPoweredBy`, `WebRealm`, `WebRedirectURL`, `WebCertificateSubject`, `WebCertificateIssuer`, `WebCertificateNotAfter`, `WebCertificateSelfSigned`). **Web Console** in the context menu opens the port (and scheme) that answered.
 
 **Type:** `Boolean`
 
 
@@ -93,7 +93,7 @@ Release date: **xx.xx.2026**
 - New **OS (guess)** column with the operating system guessed from the TTL of the ping reply (icon and text: `Linux / Unix`, `Windows` or `Network device`, the tooltip shows the number of hops), can be disabled with the new setting **Guess the operating system from the TTL** (default on). No additional packets are sent; IPv4 only. Also in the search, **Copy** and the export (`OSGuess`). [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)
 - An icon in the result marks this computer, the default gateway and the DNS and DHCP servers of the connected network interfaces (all roles in the tooltip), e.g. to find the router in a `/24`. Also in the search and the export (`Role`). [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)
 - New **Resolve mDNS hostname** setting (default off, with **Timeout**): the mDNS hostname (e.g. `macbook.local`) of reachable hosts is resolved with a reverse lookup sent to UDP port `5353` of the host (Apple devices, Linux with Avahi, Android, printers, IoT devices). Shown in the row details (new **Hostnames** section with the DNS, mDNS and NetBIOS name) and used as **Hostname** if there is no DNS hostname (before the NetBIOS name). Also in the search, **Copy** and the export (`MDNSHostname`). [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)
-- New **Read web pages** setting (default off, with **Timeout**): the web page (`GET /`) of reachable hosts with an open web port is read - the title is shown in the new **Web** column (URL in the tooltip, `Server` header if the page has no title), e.g. to identify routers, printers and NAS. The row details (new **Web** section) show the URL, the HTTP status code, the title, the `Server` and `X-Powered-By` headers, the realm of a login prompt (`WWW-Authenticate`, often the model of a router or camera) the target of a redirect to another host and, for https, the TLS certificate (subject, issuer or `Self-signed`, valid until, `(expired)`). The ports are configurable (**Ports**, default `443; 80; 8443; 8080`, tried in this order, with a button to restore the default); only ports that are open in the port scan are requested, http on `80` / `8080`, https and then http on other ports. Redirects on the same host are followed, certificate errors are accepted, no cookies or credentials are sent. **Web Console** in the context menu opens the port that answered. Also in the search, **Copy** > **Web** (title, URL, server) and the export (`WebTitle`, `WebURL`, `WebStatusCode`, `WebServer`, `WebPoweredBy`, `WebRealm`, `WebRedirectURL`, `WebCertificateSubject`, `WebCertificateIssuer`, `WebCertificateNotAfter`, `WebCertificateSelfSigned`). [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)
+- New **Read web pages** setting (default off, with **Timeout**): the web page (`GET /`) of reachable hosts with an open web port is read - the title is shown in the new **Web** column (URL in the tooltip, `Server` header if the page has no title), e.g. to identify routers, printers and NAS. The row details (new **Web** section) show the URL, the HTTP status code, the title, the `Server` and `X-Powered-By` headers, the realm of a login prompt (`WWW-Authenticate`, often the model of a router or camera) the target of a redirect to another host and, for https, the TLS certificate (subject, issuer or `Self-signed`, valid until, `(expired)`). The ports are configurable (**Ports**, default `443; 80; 8443; 8080`, tried in this order, with a button to restore the default); only ports that are open in the port scan are requested, https on `443` / `8443`, http on `80` / `8080`, https and then http on other ports. Redirects on the same host are followed, certificate errors are accepted, no cookies or credentials are sent. **Web Console** in the context menu opens the port that answered. Also in the search, **Copy** > **Web** (title, URL, server) and the export (`WebTitle`, `WebURL`, `WebStatusCode`, `WebServer`, `WebPoweredBy`, `WebRealm`, `WebRedirectURL`, `WebCertificateSubject`, `WebCertificateIssuer`, `WebCertificateNotAfter`, `WebCertificateSelfSigned`). [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)
 - New **Read the SNMP system information** setting (default off, with **Version** `v1` / `v2c`, **Community** and **Timeout**): name, description and location (`sysName`, `sysDescr`, `sysLocation`) are read with the other probes from every IP address - a host that answers is shown as up (**Detected by** `SNMP`), also if it blocks the ping and all ports - and shown in the row details (new **SNMP** section), the name also in the new **SNMP name** column, e.g. to identify switches and printers. The community is saved as plain text in the settings (warning icon next to the field, use a read-only community). Also in the search, **Copy** > **SNMP** and the export (`SNMPName`, `SNMPDescription`, `SNMPLocation`). [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)
 - The **Hostname** and **MAC address** / **Vendor** columns (and the new **Web** and **SNMP name** columns and the new row details) show `...` while the lookup / request is running instead of `-/-`, like the ping, port and NetBIOS columns, so a missing value can be told apart from one that is still resolved. **Hostname** and **MAC address** / **Vendor** show `...` until all their sources are finished (DNS, mDNS and NetBIOS name / neighbor table and NetBIOS). **Copy** > **Hostname** / **MAC address** / **Vendor** is disabled until the value arrived. [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)
 - The **Ping status**, **Port status** and **NetBIOS reachable** columns show a status icon (green check / red cross, like the action of a rule in the **Firewall**) instead of the text (e.g. `Success` / `Timed out`, `Open` / `Closed`, `Yes` / `No`); the tooltip shows the details: ping status with time and TTL, the open ports with their service and the NetBIOS computer name and workgroup / domain. [#PR](https://github.com/BornToBeRoot/NETworkManager/pull/PR)