I run a server whose only public open port is 80, serving non-encrypted data over HTTP, not HTTPS. Is it affected by Heartbleed?
Teun Vink is right, it's not vulnerable if you are certain that https is turned off, for example by turning mod_ssl off.
Even if you don't actively use https, it may still be enabled. Many servers have https enabled by default with some automatically generated certificate. This will not be valid and throw an error or warning in browsers, but it will still be exploitable.
If you can modify the apache configuration, disable mod_ssl with
a2dismod ssl. On Windows I'm not sure this works; for example in a xampp installation you should edit the httpd.conf file in the
xampp/apache/conf folder. Put a pound sign (#) in front of the line that says
LoadModule <something_with_ssl> so it becomes
If disabling mod_ssl causes problems in other parts of the configuration, you can also simply make sure that the only
Listen option is for port 80. You should search in all configuration files for those
Listen options, for example with grep or on Windows you could use Notepad++' search in files feature.
In any case, it's advisable to update OpenSSL if possible. Other stuff may be using it, or someone may turn https on in the future without realizing that it's vulnerable.
TL;DR: Update OpenSSL if at all possible, even if you are not vulnerable. If not possible, make absolutely certain you're not using https.